Phishing and vishing drive rising Q3 ransomware activity, Cisco Talos finds

Phishing continued to serve as the primary initial access technique in the third quarter of 2026, Cisco Talos reported. The security firm observed phishing in slightly over one-third of all incident response engagements during the quarter. Cisco Talos noted that this represents a decrease from the previous quarter, when phishing featured in more than 50 percent of cases. [1]

Hackers increasingly conducted voice phishing attacks paired with IT help desk impersonation, Cisco Talos reported. The group used these social engineering tactics to trick victims into granting remote access through legitimate remote monitoring and management tools. The finance and public administration sectors tied as the most targeted industries during the period. [1]

The findings follow a broader surge in cyber threats, as FTMQ Security reported earlier. Global ransomware attacks reached a record volume in the third quarter of 2026, with incidents in the finance sector rising by 72 percent compared to the prior quarter. [6]

Cisco Talos reported that the overall proportion of ransomware and pre-ransomware cases increased throughout the third quarter, alongside the continued exploitation of public-facing applications. [1]