Fraudsters are talking their way past help desks, Dark Reading says

Attackers do not need malicious software to get inside an organisation any more. According to a commentary published by Dark Reading on 23 October 2026, titled "Trust Is Not What It Seems — And Fraudsters Are Counting on It", threat actors are "simply calling help desks and politely asking for access, with a little help from artificial intelligence".

The piece frames this as a shift in where the weak point sits. Rather than finding a flaw in software, the attacker finds a person whose job is to be helpful. Help desks exist to unlock accounts, reset passwords and restore access for staff who are stuck. That is a useful function, and it is also a route in if the caller cannot be reliably identified.

The central claim in the Dark Reading article is about trust itself: that the signals people use to decide whether someone is who they say they are are no longer dependable, and that fraudsters are counting on defenders not noticing. The article says artificial intelligence is assisting the callers, though the published summary does not set out which tools are used or how often the technique succeeds.

For readers tracking AI agent security, the relevance is direct even though the commentary does not discuss agents specifically. The same identity problem that affects a human support agent on a phone call affects any automated system that acts on instructions it receives. If a request arrives that looks legitimate and sounds urgent, something has to decide whether to grant the access. Where that decision rests on how convincing the request seems, rather than on a verified credential, the decision is exposed.

The Dark Reading item is an opinion and analysis piece rather than an incident report. It does not name a victim organisation, a vendor whose product was abused, or a specific campaign. No breach figures, no affected user counts and no attribution are given in the published summary. Readers should treat it as a description of a technique and a risk argument, not as a disclosure.

What the article does underline is a practical question for anyone running a support function or an automated approval workflow. If an attacker can reach a human or a system and ask for access in plain language, the control that matters is not the malware scanner. It is the step that proves the requester is real before anything is granted. On the evidence of this commentary, that step is where fraudsters are currently placing their bets.