The cyber-crime collective known as Scattered LAPSUS$ Hunters (SLH) has begun targeting users of Zendesk in a fresh phishing campaign, according to a new alert by cybersecurity firm ReliaQuest. Researchers have identified more than 40 typosquatted and impersonating Zendesk-related domains created over the past six months — some hosting fake single sign-on pages to steal credentials, others used to submit malicious support tickets aimed at infecting help-desk personnel with malware such as remote-access trojans. The group reportedly exploited a support portal breach at Discord, exfiltrating sensitive user data, and has signaled plans for further campaigns through early 2026. Organizations are now being urged to treat customer-support platforms like Zendesk as critical infrastructure and apply the same security discipline as with core IT systems.
Sources: TechRadar, CSO Online
Key Takeaways
– SLH registered over 40 fraudulent domains resembling Zendesk URLs, using them to harvest credentials via fake SSO portals or to deliver malware through spoofed support-ticket submissions.
– The group’s modus operandi reflects a pivot toward attacking customer-support systems, considered “low-hanging fruit,” rather than traditional enterprise networks — evidencing a shift toward human- and infrastructure-centric social engineering.
– Firms relying on SaaS-based help-desk platforms must elevate security: enforce robust MFA, monitor for typosquatted domains, restrict support-ticket privileges, and treat help-desk tools as part of their critical attack surface.
In-Depth
The fallout from the latest wave of cyber-threats is hard to overstate: after a string of high-profile breaches targeting major SaaS platforms, the group calling itself Scattered LAPSUS$ Hunters has turned its attention to Zendesk — a customer-support backbone for hundreds of thousands of businesses worldwide. The alarming discovery, detailed by security firm ReliaQuest, reveals more than 40 new domains bearing names like “vpn-zendesk[.]com” and “znedesk[.]com” — blatant typosquatting that mimics legitimate Zendesk URLs. Some of these domains host counterfeit single sign-on (SSO) portals, engineered to trick users into entering their credentials. Other domains are used to lodge fraudulent support tickets to real Zendesk portals, aiming to expose help-desk personnel to remote-access trojans or other forms of malware.
This campaign marks a cunning evolution of tactics: after all, email has long been the primary vector for phishing. By shifting toward support-portal infrastructure, SLH is exploiting systems that organizations frequently overlook — assuming they’re safer or less critical than email or external web applications. In many firms, support portals are handled by lower-privileged staff or third-party agents, and may lack the same security hardening as core platforms. That creates an enticing attack surface for social-engineering operators who are adept at impersonation and credential-theft schemes.
The timing is significant, too. SLH’s interest in Zendesk coincides with their alleged involvement in a recent data breach at Discord, where hackers reportedly accessed Discord’s Zendesk-based support system and walked away with names, email addresses, IPs, billing info, and even government-issued IDs. While SLH has denied responsibility for that specific breach — calling the attribution “hilarious” — the technical footprint of the Zendesk-spoofing domains matches their known pattern: typosquatting, registration through NiceNic, masked Cloudflare nameservers, and US/UK contact info. That strongly suggests this is not a random act, but a coordinated operation following similar efforts against other SaaS platforms earlier in 2025, such as Salesforce and Gainsight.
For companies still treating their help-desk tools as ancillary, this should be a wake-up call. As ReliaQuest warns, the next few months — especially the upcoming holiday season — are a prime time for SLH to strike, particularly when incident-response teams may be under-staffed or distracted. The group itself reportedly notified followers on Telegram that “3–4 campaigns” are in progress and urged IR staff to watch their logs through January 2026.
What should organizations do? For starters, treat customer support platforms with the same security rigor as core infrastructure. Require hardware-based multi-factor authentication for all accounts with administrative or support privileges. Enable strict session-timeout policies and IP allow-listing whenever possible. Deploy domain-monitoring tools or subscribe to a digital-risk-protection service that can alert you when typosquatted versions of your SaaS domains appear. Restrict who can submit support tickets, and apply content filtering and link-scanning to detect potentially malicious attachments or URLs.
This may not stop every attempt — where human trust is involved, there will always be risk — but implementing those layers of defense will dramatically raise the cost and complexity of a successful attack. In today’s threat environment, it’s no longer sufficient to harden firewalls and patch servers; organizations must remember: the weakest link may be the help-desk portal itself.