Q3 2026 Cybersecurity Trends: Vishing, Ransomware Surge, and AI's Dual Role
Cisco Talos' Q3 2026 report highlights a rise in vishing attacks impersonating IT help desks, increased ransomware activity, and the dual use of AI as both a weapon and a target.
Cisco Talos' Incident Response (IR) team observed a notable shift in cyberattack vectors during the third quarter of 2026. While phishing remained the leading initial access technique, its prevalence decreased slightly to just over one-third of all engagements. A significant trend within this vector was the rise of voice phishing (vishing), where threat actors impersonated IT help desk personnel to socially engineer victims into granting remote access, often through legitimate remote monitoring and management (RMM) tools. This tactic leverages the trust users place in internal support to bypass traditional security awareness training.
Exploitation of public-facing applications constituted the second most common attack vector, accounting for another third of Talos IR engagements. Threat actors predominantly targeted edge devices such as security gateways and remote network management interfaces. These critical components, often responsible for authentication and network traffic management, provide a high-value target for attackers seeking broad access to internal networks or sensitive user credentials. The continued reliance on these devices without adequate security hardening presents a persistent risk to organizations.
Ransomware and pre-ransomware incidents saw a significant increase, rising to 27 percent of engagements in Q3 2026, up from a previous maximum of 20 percent. Talos responded to attacks involving sophisticated RaaS variants like The Gentlemen, Qilin, and Rhysida, alongside the closed-group operation Interlock. A key tactic observed was the disabling of endpoint detection and response (EDR) systems, frequently achieved by exploiting vulnerable drivers or leveraging Windows Defender Application Control (WDAC) to circumvent defenses. The emergence of the VYPR ransomware variant also indicated an immature but evolving threat landscape, with its operators testing various TTPs.
The report also detailed ongoing cyber espionage campaigns attributed with high confidence to China state-sponsored threat actors, including Salt Typhoon. These actors routinely gained initial access by exploiting vulnerabilities like CVE-2023-20198 in public-facing web interfaces and leveraging valid credentials. The deployment of the BadCandy web shell provided persistent and stealthy remote access, while the adversaries employed living-off-the-land (LOTL) tactics to blend in with normal administrative operations, disable logging, and manipulate configurations to maintain persistence.
These Salt Typhoon intrusions exposed critical security weaknesses, including a reliance on password-only authentication without MFA, the use of weak legacy management protocols, and inadequate credential management. The absence of strong MFA and robust credential management practices were frequently observed security shortcomings, enabling attackers to operate with relative impunity.
Artificial intelligence emerged as both a tool and a target in cybersecurity incidents during Q3 2026. In one instance, an insider used AI-powered development tools like GitHub Copilot CLI and Anthropic Claude Code to potentially automate malicious actions. In another, a compromised macOS endpoint was scripted to scrape credentials specifically associated with the Anthropic Claude Code AI assistant, highlighting a new threat vector targeting AI-related secrets.
These findings underscore the evolving nature of cyber threats, emphasizing the need for organizations to bolster their defenses against social engineering, secure public-facing applications, and implement robust security measures, particularly strong MFA and comprehensive credential management, especially in the context of emerging AI technologies.