Social Engineering Didn’t Die in the AI Age. It has got an Upgrade.

We spend extraordinary sums defending the edge. Next-generation firewalls, endpoint detection on every laptop, a SOC watching the network for the faint signature of something moving where it shouldn’t. Then someone’s phone rings, a calm voice says “Hi, it’s IT, I can see the spam hitting your inbox, let me help,” and within eleven hours an attacker is sitting on ten of your machines. None of the expensive kit got a vote, because the breach didn’t go around it. It walked past the one part of the perimeter we never patch: a person having a bad morning.

That’s the uncomfortable lesson in a campaign Huntress documented in February 2026, and it deserves a CISO’s full attention, not because the malware is novel but because the way in was so ordinary.

The tool is the least interesting part of the story

Let me deal with the headline first, because the headline is a distraction. The payload in these attacks is Havoc, an open-source command-and-control framework, the kind of post-exploitation kit that gives an attacker a remote shell, lateral movement, payload delivery, the works. It’s capable, it’s modular, and it’s free. It’s the off-the-shelf successor to expensive commercial kits like Cobalt Strike, and it does a competent job of slipping past an up-to-date Microsoft Defender using indirect syscalls and sleep obfuscation, the technical sleight-of-hand that keeps a payload quiet while the endpoint agent looks straight at it.

Here’s the detail that tells you how little the tool itself matters: the Havoc project was archived in February 2026, the same month these intrusions were found. Unmaintained, in other words. It didn’t slow anyone down. The source is still public, so attackers fork it, bolt on their own tricks, and the Huntress samples came with custom registry-based fallback channels the stock version never shipped with. When a “dead” tool is still breaching live enterprises, you’ve learned something: the framework was never the hard part. Getting in was. And getting in had nothing to do with Havoc.

The real attack is a five-minute conversation

Strip away the malware and look at the choreography, because this is the part you can actually defend against.

It starts with email bombing. The attacker floods an employee’s inbox with thousands of junk messages in minutes. This isn’t the attack; it’s the setup. It manufactures a small crisis and an anxious person, and it hands the attacker a pretext. Then comes the phone call, the IT service desk, returning your “ticket,” already aware of the spam storm you’re staring at, offering to make it stop. In at least one case the attacker rang the victim’s personal mobile, which tells you the targeting was deliberate, not spray-and-pray.

From there it’s all consent. The “technician” asks the employee to start a Quick Assist session or install AnyDesk, ordinary remote-support tools, nothing a security product would flag, because the user invited them in. They’re walked to a convincing Microsoft page (hosted on AWS, naturally, to borrow the trust of a name everyone knows) to “update their anti-spam rules,” which quietly harvests their password along the way. By the time a malicious DLL is sideloaded and the Havoc agent wakes up, the attacker isn’t breaking in. They were shown in, by an employee who believed they were being helped.

This is the reframe that matters. We classify this as a malware incident because malware is what we found. It was a social engineering incident that happened to end in malware. The control that failed wasn’t technical. It was the absence of a way for a worried employee to know the helpful voice was a stranger.

Why this should worry you more than a zero-day

A clever exploit is a problem you can often buy your way out of: patch it, deploy the signature, move on. This is harder, because it targets the layer no patch reaches, and the numbers say it works. eSentire’s 2026 threat report put the success rate of this fake-IT-support pattern at 72%, with sharp growth through 2025. The playbook traces back to the Black Basta ransomware crew’s leaked internal chats, and a leaked playbook doesn’t retire when the gang goes quiet; it gets copied. Different actors, same script, again and again.

Three things make it potent, and each one is a deliberate inversion of a defence you already trust:

• It weaponises your own helpfulness. Every instinct you train into staff, cooperate with IT, resolve the problem quickly, is the instinct the attacker rents for the length of a call.
• It uses legitimate tools, so your stack stays quiet. Quick Assist, AnyDesk, RMM agents: these aren’t malware, so EDR has no reason to scream. Huntress found attackers leaving RMM tools behind specifically as backup persistence, so wiping the Havoc payload doesn’t evict them.
• It moves faster than your response process. Initial access to lateral movement across nine more endpoints in eleven hours. Most organisations can’t convene an incident call that quickly, let alone contain one.

What actually moves the needle

You don’t fix this by buying another box. You fix it by hardening the human path the attacker is exploiting, and most of that is policy and muscle memory, not spend.

Give people a verification reflex that beats the panic. The single highest-value habit you can build: no one from IT ever gets remote access on an inbound call. Full stop. If “IT” rings, the employee hangs up and calls the known internal number, every time, no exceptions, no judgment calls under pressure. Say it until it’s boring, then say it again.

Take the dangerous tools off the table by default. Quick Assist, AnyDesk and unsanctioned RMM agents should be blocked unless a team genuinely needs them, and where they’re allowed, allow-list the specific tool and alert on anything else. An RMM agent appearing on a finance laptop at 9pm is not background noise; it’s the incident.

And treat email bombing as the alarm it is. A sudden inbox flood isn’t just a nuisance for the mail filter to absorb, it’s frequently the opening move, the thing that happens minutes before the phone rings. Wire your mail platform to flag a sudden volume spike to the SOC, and you turn the attacker’s own setup into your early warning.

The framework had a name this time, Havoc, and next quarter it’ll have a different one. Chasing the tool is a treadmill. The constant across every version of this attack is a human being persuaded to open the door, and that’s the perimeter worth investing in. Defend the firewall by all means. Just remember the breach already learned to use the phone.