Cisco Talos' Q3 2026 IR report flags help-desk impersonation and remote-support tool abuse. In one case, a user was tricked into Quick Assist; attackers then used existing RMM software. The exact pretext wasn't confirmed. For MSPs: verify support requests through known channels and alert on unexpected RMM sessions. Ransomware/pre-ransomware appeared in 27% of Talos IR cases, not all incidents worldwide. https://blog.talosintelligence.com/ir-trends-q3-2026/ #Cybersecurity #Infosec #MSP