Beware of Fake IT Support: Why Zero Trust Matters More Than Ever

You get a message. It looks official. Someone claims to be from IT and says there is an issue with your account that needs immediate attention. You are busy. It feels routine.

That message may not have come from IT at all.

Attackers impersonating helpdesk staff have become one of the most effective entry points into business networks. Voice phishing attacks surged 442% between the first and second halves of 2024, according to the CrowdStrike 2025 Global Threat Report. Mandiant’s M-Trends 2026 report ranked voice phishing as the number two most common initial infection vector of 2025. This is no longer a fringe tactic. It is how serious breaches begin.

Attackers Have Stopped Trying to Break In Through the Back Door

Rather than fight through technical barriers, attackers started asking nicely. Impersonation attacks, where a threat actor pretends to be IT support, a vendor, or a colleague, now represent a significant share of all initial intrusions. The 2025 Unit 42 Global Incident Response Report found that 45% of social engineering attacks involved impersonation of internal personnel. Attackers reach out via email, Microsoft Teams, phone calls, or text, with one consistent goal: get the target to install a remote access tool, hand over credentials, or approve an MFA request they did not initiate.

The MGM Resorts breach illustrated how far a single call can go. Attackers contacted the IT help desk, impersonated an employee using details pulled from LinkedIn, and passed identity verification. The result was roughly ten days of downtime and an estimated $100 million in losses.

Zero Trust Is a Way of Thinking, Not a Product You Install

Zero Trust is built on one principle: never trust, always verify. Every access request is treated as potentially suspicious regardless of where it originates, what device is being used, or whether the user has authenticated before.

In practice, that means identity is always confirmed through a known, trusted channel, not the one the requester provides. If someone claims to be from IT and asks you to install a tool, the right move is to contact IT through a number or channel you already have on file, confirm the request is legitimate, and then proceed. A genuine IT team will not object to that process. If the person on the other end pushes back or manufactures urgency around skipping verification, that is the signal.

What Makes Your Environment More Vulnerable to This Attack

CTI Technology’s onboarding assessments across Chicago-area businesses regularly surface the same gaps that make helpdesk impersonation attacks easier to pull off:

• Excessive administrative permissions, meaning a compromised account has far more reach than necessary
• Inconsistent MFA enforcement across accounts and access points
• Unmanaged accounts for former employees or unused services
• No documented IT request process, leaving users with no baseline for what legitimate contact actually looks like

That last gap is the one attackers count on most. Ambiguity about what real IT support looks like is the opening they walk through.

What to Tell Your Team

Users do not need an hour-long security course. They need a few clear rules that hold up under pressure:

• Verify through a channel you already have. If someone messages you asking to call a number, call a different number you have on file.
• Urgency is a tactic. Attackers manufacture pressure to short-circuit careful thinking. Legitimate IT requests do not require you to skip verification.
• Asking for verification is appropriate, not rude. A real IT provider expects it. A fake one is hoping you skip it.

CTI Technology includes documentation of support channels and request procedures as part of every onboarding, so users have a reference point when something feels off.

If your organization does not have a documented IT request process or clear guidance for staff on verifying unexpected contact, that is worth addressing before an incident makes it urgent. To talk through where your environment stands, [contact CTI Technology].

Aaron Kane

CEO of CTI Technology

Aaron Kane is the CEO of CTI Technology, a Chicago-based IT services provider helping businesses navigate technology with confidence. With expertise in IT strategy, infrastructure, cloud solutions, and voice technologies, Aaron focuses on helping organizations improve efficiency, strengthen operations, and make smarter technology decisions. Under his leadership, CTI Technology has continued to grow while maintaining a strong focus on service and long-term client relationships.

Connect with Aaron on Linkedin