When Trust Becomes the Attack Surface
Executive Lessons From a Helpdesk Impersonation Intrusion
-
October 30, 2026
-
FTI Consulting’s Cybersecurity team recently investigated an intrusion that did not begin with exploitation of an unpatched vulnerability, a malicious attachment or stolen credentials. Instead, the attacker entered through a trusted business process: IT support. After flooding an employee’s inbox with hundreds of subscription and newsletter confirmations to create confusion — a tactic known as email bombing — the attacker contacted the employee through Microsoft Teams, impersonated internal IT support and persuaded the employee to open Microsoft Quick Assist, a legitimate remote-support tool.
From the employee’s perspective, the interaction looked like a standard helpdesk session. In reality, it gave the attacker hands-on control of the employee’s computer. Within minutes of the remote-support session starting, the attacker downloaded and executed a malware package known as KeyRoll or Sauron that abused a legitimate program to run two malicious files; by roughly twenty minutes into the session, the attacker had established persistence through a scheduled task. The activity blended into normal patterns many security tools are designed to permit because the remote-support session appeared user-approved and the malicious code ran through a trusted, signed software pathway.
The intrusion was contained because the employee noticed inconsistencies with a normal helpdesk experience, became suspicious, and contacted the real helpdesk. Incident responders isolated the affected endpoint approximately 41 minutes after the Microsoft Quick Assist session began. That quick containment prevented data exfiltration, lateral movement and additional attacker tasking. Notably, the decisive control was not an automated alert: No Endpoint Detection and Response (EDR), Extended Detection and Response (XDR), identity or email security controls generated a detection before the employee reported the activity.
Shifting Attack Tactics
This incident illustrates a broader shift in the cyber threat landscape. Attackers are increasingly seeking higher returns by abusing the workflows, tools and trust relationships organizations depend on every day. In these instances, an attacker does not need to defeat a hardened perimeter or exploit a software vulnerability; the attacker needs an employee to accept a request that appears legitimate.
The Keyroll / Sauron malware deployed in this case also created serious downstream risk. Analysis showed that the implant was capable of downloading and executing additional payloads, running scripts, capturing screenshots and installing a kernel driver under a randomly generated service name if instructed. Those capabilities were not activated before containment, but they demonstrate how quickly a seemingly limited helpdesk impersonation can become a broader enterprise security problem.
This scenario also highlights a gap in many security programs. Several parts of the activity looked legitimate when viewed separately: The remote-support tool was approved technology; the host executable was signed by a reputable publisher, and the network traffic was small. The problem was the pattern. Taken together, those events showed an attacker using normal business tools for an abnormal purpose, illustrating that “known,” “signed” or “user-approved” does not necessarily mean safe.
How Organizations Can Reduce the Risk
- Treat remote support as sensitive access. Remote-support tools should only be used through approved, logged and verifiable support processes.
- Make verification easy for employees. Employees should know how to confirm whether a support request is real before allowing anyone to connect to their device.
- Train for helpdesk impersonation Security awareness programs should include scenarios in which attackers pose as IT support after creating a confusing or urgent issue.
- Look for suspicious combinations of events. A virtual call, a remote-support session, a file download, a new scheduled task and a small outbound connection may look harmless alone, but together they can indicate an intrusion.
- Do not rely only on whether software is “known.” Legitimate programs can be misused, and signed files can still be part of malicious activity.
- Respond based on access, not just confirmed theft. Even without observed data exfiltration, an attacker may have exposed credentials, tokens, certificates or other sensitive material.
- Preserve evidence before shutting down systems. Isolating a device before powering it off can help investigators understand what happened and whether the attack spread.
Executive Takeaway
Attackers are learning to turn familiar tools, communication channels and support workflows into opportunities for intrusion. Organizations should respond by making remote support verifiable, training employees to pause before granting access and building detections that look at the full context of an event rather than trusting each tool in isolation.
The views expressed herein are those of the author(s) and not necessarily the views of FTI Consulting, Inc., its management, its subsidiaries, its affiliates, or its other professionals.
Related Insights
Published
October 30, 2026
Key Contacts
Senior Managing Director