Zendesk Environments Targeted by Scattered Lapsus$-Linked Credential Campaign

Reliaquest researchers report that actors affiliated with the Scattered Lapsus$ Hunters are preparing or launching a threat campaign against Zendesk environments, using typoquatted domains and fraudulent support tickets to harvest high-privilege credentials, mapped to MITRE ATT&CK techniques T1566 (Phishing), T1078 (Valid Accounts), and T1204 (User Execution). Over the past six months, more than 40 impersonating domains mimicking Zendesk instances have appeared, some hosting fake single sign-on portals designed to trick users into entering corporate login details. The primary targets are system administrators and helpdesk personnel at organizations that rely on Zendesk for customer service, due to their elevated access. Beyond lookalike portals, the campaign also abuses legitimate Zendesk workflows by submitting fraudulent tickets to real customer support portals operated by victim organizations. These tickets are crafted to entice helpdesk staff into opening malicious attachments or links, leading to infection with remote access Trojans (RATs) and other malware. Domain registration patterns show Cloudflare-protected name servers and registrant data in the US and UK, with registration via NiceNik, echoing infrastructure used in an earlier August campaign targeting Salesforce environments that was also linked to Scattered Lapsus$ Hunters. The business impact for Zendesk-dependent organizations includes potential compromise of admin accounts, unauthorized access to customer data, and pivoting into connected CRM, billing, or identity systems. Successful credential harvesting and RAT deployment can enable wide-reaching data theft, ticket manipulation, and abuse of communication channels for phishing and social engineering, potentially leading to regulatory concerns if customer data is exposed. Defenders should tighten identity controls around Zendesk and other customer service platforms by enforcing MFA for admins and helpdesk accounts, implementing SSO with phishing-resistant factors, and monitoring for logins from unusual domains or IP addresses. Security teams should block newly observed Zendesk-like domains, educate support staff about fraudulent tickets, and integrate Reliaquest’s indicators into email, DNS, and web filtering systems to detect and stop the campaign before credentials or endpoints are compromised.