IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases

In Q3 2026, Cisco Talos Incident Response observed a shift in cybercriminal tactics, with phishing remaining a primary initial access vector, alongside a rise in voice phishing (vishing) impersonating IT help desks. Simultaneously, AI was increasingly used both as a tool and a target, with threat actors exploiting AI platforms for credential theft and automation. The report highlights critical security weaknesses including insufficient logging, weak authentication, and a growing reliance on AI tools for malicious purposes, emphasizing the need for stronger MFA.