Scattered Lapsus$ Hunters Target Zendesk in New Supply-Chain Campaign

Du'aine Davis

Observed in the wild

• ReliaQuest uncovered over 40 typosquatted and impersonating domains mimicking Zendesk environments, signalling a new campaign by the “Scattered Lapsus$ Hunters” collective. These domains, registered within the past six months, host phishing pages and fake SSO portals to steal credentials. Fraudulent tickets are also being submitted to legitimate Zendesk portals, aiming to infect help-desk staff with malware. This follows similar attacks on Salesforce and Gainsight earlier in 2025.
• Attackers employ a multipronged approach: external phishing via fake Zendesk domains and internal compromise through malicious ticket submissions. Techniques include credential harvesting, social engineering pretexts (e.g., urgent admin requests), and malware deployment such as RATs. Domains share registry traits (NiceNic registration, Cloudflare-masked nameservers), consistent with prior Scattered Lapsus$ Hunters campaigns.
• Organisations are advised to enhance protections around Zendesk. Key actions include enforcing MFA with hardware keys, IP allowlisting, and session timeouts; deploying proactive domain monitoring and DNS filtering to block typosquatted domains; and using Microsoft Defender or similar tools to detect suspicious MFA activity, terminate compromised sessions, reset passwords, and scan hosts for malware. Limiting Zendesk chat exposure and applying content filtering for phishing patterns further reduces risk.

Is Zendesk Scattered Lapsus$ Hunters’ Latest Campaign Target?