Extortion Groups Impersonate IT Help Desks to Steal Identities and Maintain Cloud Access

Extortion groups are impersonating internal IT support through voice calls and external Microsoft Teams messages to gain access to enterprise accounts. ReliaQuest reported a surge in these techniques, with its June–August 2026 findings linking identity-led intrusions to ShinyHunters and Helix. Attackers persuaded employees to approve authentication requests, complete device-code authentication, or install remote-support software. Stolen tokens, altered multifactor authentication settings, and attacker-controlled device registrations enabled persistent access that sometimes survived routine password resets or session termination. Compromised identities were then used to enumerate SharePoint sites and download data for extortion across multiple industries.

These intrusions can initially resemble legitimate authentication and account-management activity, making isolated login alerts insufficient to establish the full scope of compromise. Legitimate remote-management tools and over-privileged accounts also supported persistence, lateral movement, and data collection; ReliaQuest separately observed the Gryxa toolkit using remote-management software for redundant persistence. Defenders should correlate identity and authentication changes with subsequent SaaS access and administrative activity, rather than treating a password reset as complete remediation. ReliaQuest recommends removing unauthorized authentication methods and persistence mechanisms, verifying endpoint monitoring coverage, and retaining sufficient logs to determine whether attackers stole data.