Cybersecurity

Infostealer logs are quietly fuelling a wave of helpdesk social engineering

Attackers arrive at the service desk already knowing the manager's name, the ticket history and the last device serial.

Mara Ellison

Senior Threat Reporter • 23 Jul 2026 • 7 min read

Night-time view of illuminated office towers and data cables — Identity verification at the service desk is now a security control. Photo: Unsplash

Three large retailers were compromised in July through MFA resets granted over the phone to convincing callers. This story is developing and will be updated as our newsroom confirms further detail with affected organisations and responders.

#Social Engineering
#Identity
#Retail

Abstract padlock rendered over dark blue server hardware

Cybersecurity

StormVeil ransomware crew pivots to ERP backup appliances in coordinated European campaign

At least 41 manufacturers across Germany, Poland and the Netherlands have been hit since 2 July, with the operators abusing legitimate backup agent credentials.

Mara Ellison29 Jul 20268 min read

Dark data centre corridor with blue indicator lights

Cybersecurity

Zero-day in a widely deployed VPN gateway exploited three weeks before the vendor patch

An authentication bypass in the appliance's session handler allowed unauthenticated attackers to mint valid tokens for any user.

Tomas Berg26 Jul 20265 min read

Analytics dashboard with charts on a dark screen

Cybersecurity

Detection engineering teams move to pipeline-first telemetry to cut SIEM spend

The trade-off is a new operational burden: the pipeline itself now needs testing, versioning and on-call ownership.

Helena Vasquez16 Jul 20266 min read

Infostealer logs are quietly fuelling a wave of helpdesk social engineering

Related Stories

StormVeil ransomware crew pivots to ERP backup appliances in coordinated European campaign

Zero-day in a widely deployed VPN gateway exploited three weeks before the vendor patch

Detection engineering teams move to pipeline-first telemetry to cut SIEM spend