Scattered Lapsus$ Hunters Target Zendesk with Typosquatted Domains

First seen 28 Nov 2025, 06:35 UTC • •26

Article Content

1 / 3

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

The Scattered Lapsus$ Hunters have launched a cyber offensive exploiting supply-chain vulnerabilities by registering over 40 typosquatted domains that mimic Zendesk environments. This campaign aims to turn Zendesk, a widely used customer support platform, into a tool for corporate espionage. Organizations using Zendesk may be at risk of being targeted through these malicious domains.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 241d ago How this analysis works

Threat Graph

4 entities, 3 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (1)

Lapsus$ Hunters

Technique (2)

Phishing
Supply Chain Attack

Organization (1)

Zendesk

Relationships

Lapsus$ Hunters uses Phishing
Lapsus$ Hunters uses Supply Chain Attack
Lapsus$ Hunters targets Zendesk

Following this threat?

Track Lapsus$ Hunters and Zendesk in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Scattered Lapsus$ Hunters Target Zendesk with Typosquatted Domains

Article Content

More articles in this cluster (2)

Threat Graph

Following this threat?

Extracted Entities (4)

APT Groups (1)

Attack Types (2)

Companies (1)