Threat Intelligence

Fraudsters Are Skipping Malware and Simply Asking Your Help Desk for Access

Dark Reading · 24 Oct 2026

Key Takeaway Set a firm identity verification process for every help desk request involving passwords, access or account changes, and make sure staff are comfortable saying no when it cannot be completed.

Many businesses still picture a cyber attack as malicious software slipping past their defences. According to Dark Reading, that picture is increasingly out of date. Threat actors no longer need malware to breach an organisation. They can simply call a help desk and politely ask for access.

Artificial intelligence is helping make these requests more convincing. The source summary does not say exactly how the technology is used, but the message is clear: a friendly, plausible voice on the phone can be enough to get past a business that relies on trust.

For small businesses, this matters because help desks, whether in-house or outsourced, are built to be helpful. That is the quality fraudsters are counting on. Staff who handle password resets, account changes or access requests are now an important line of defence, and they need clear processes to follow when a request sounds reasonable but cannot be verified.

social engineering help desk security AI threats identity verification

Summarised by CISO AI from Dark Reading, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.