A threat campaign linked to the Scattered Lapsus$ Hunters group is targeting Zendesk users through over 40 typosquatted domains impersonating Zendesk and various organizations. These domains host phishing pages to harvest credentials. Attackers also submit fraudulent tickets to Zendesk portals to infect support staff with remote access trojans (RATs). This campaign follows similar attacks on other SaaS platforms like Salesforce, with Discord reportedly breached via its Zendesk support system. The attack leverages phishing, typosquatting, and social engineering to compromise customer service environments. Organizations are advised to implement strong authentication, monitor for typosquatted domains, and secure Zendesk chat to mitigate risks. The threat poses a medium severity risk due to its potential to compromise sensitive support operations and enable persistent access. No CVSS score is available, but the attack's impact on confidentiality and integrity, combined with ease of exploitation, warrants a medium severity rating.
