A threat group linked to the Scattered Lapsus$ Hunters collective is targeting organizations that use Zendesk by standing up more than forty typosquatted domains that impersonate legitimate customer support environments. This infrastructure appears designed to capture single sign-on (SSO) credentials from support agents and end users. It also serves as a staging ground to push malicious content into helpdesk workflows.
ReliaQuest reports that the attackers have registered lookalike domains over the past six months that mimic corporate Zendesk tenants. These domains are sometimes paired with fake SSO pages and login portals. Other domains are used to submit tickets that direct support staff to attacker-controlled links or payloads. This extends a broader pattern in which Scattered Lapsus$ Hunters has targeted SaaS providers and customer-facing platforms, expanding on tactics seen in earlier Lapsus$ targeting of cloud and authentication providers.
The campaign is not limited to simple credential harvesting. In some cases, malicious tickets appear to be used as a beachhead for deeper intrusion and potential extortion. These attacks combine social engineering against support personnel with attempts to compromise back-office systems. Researchers tracking the group also note a shift toward toolkit style operations that resemble extortion-as-a-service, where infrastructure and playbooks can be reused or shared among threat actors.
For organizations relying on Zendesk, the campaign underlines the critical need to treat helpdesk platforms as part of the identity perimeter. Recommended countermeasures include enforcing phishing-resistant multi-factor authentication for both internal users and support vendors. Security teams should also monitor for lookalike domains that target staff or customers and restrict helpdesk access paths. Placing stricter controls on links and attachments inside tickets is also essential.
Security teams may also want to revisit third-party support arrangements. Outsourced helpdesk providers can easily become an indirect route into sensitive environments if their own security practices are lax. This activity adds to a growing body of evidence that attackers are comfortable abusing support tooling, identity workflows, and SSO infrastructure in combination rather than going after primary identity providers alone. The helpdesk is no longer just a support function; it is a frontline defense that requires the same level of identity security as any other critical enterprise system.
Sources: ReliaQuest, CyberPress, The Register, Infosecurity Magazine, ITPro, ExploreSec
—
By the ID Tech Editorial Team
