Between January and May 2026, a financially motivated crew that Google Mandiant tracks as UNC3753 worked through dozens of professional, legal, and financial services firms across the United States. The new piece is the physical access. Operators showed up in person. Mandiant’s writeup describes physical intrusions stapled to the front of a data-theft extortion campaign, and that’s a cybersecurity pattern most U.S. enterprises are not staffed to defend against.

Vishing-led intrusion has been the dominant initial-access method for the last 18 months. Scattered Spider taught the industry that an IT-savvy native English speaker on a help-desk call beats most MFA controls. UNC3753 took the next step. They combined the phone work with people who walked into reception areas, made small-talk with security guards, and in at least some cases dropped USB devices or photographed badge layouts. The phone call sets the pretext. The in-person visit closes it.

Dozens Of US Firms, One Hybrid Crew, Five Months

Mandiant and the Google Threat Intelligence Group attribute the campaign to a single tracked actor. The targeting is narrow on purpose. High-margin services firms, mostly mid-market, with the kind of confidential client data that supports extortion. The model is straightforward: pull the data, threaten public release, demand payment in cryptocurrency. The reason this works isn’t sophistication, and it isn’t a novel exploit chain. The victims are not used to defending physical access at the same threshold as their network perimeter.

Reception desks are staffed by people whose job is hospitality. Visitor logs are a courtesy, not a control. Badge cloning is a five-minute YouTube exercise. Once an attacker is inside, even briefly, they can drop a network implant, photograph an unlocked screen, or simply observe the layout for the next round of phone calls. Defense in depth in physical space looks nothing like the network playbook most security teams have rehearsed, and almost no SOC has telemetry that crosses the two.

What Mandiant’s Telemetry Tells You About The Tradecraft

The Mandiant blog is light on specifics, which is deliberate. From the targeting and the language we can infer the shape: at least some intrusions involved tailgating, fake vendor visits (HVAC, IT courier, fire inspector), and follow-on access to unattended workstations. None of this is novel tradecraft, and red teams have demonstrated it for years. What is novel is that an extortion crew with no nation-state backing is willing to put operators on a plane.

The economic math has changed. Insurance-driven ransom payments fell off through 2025. Pure encryption-style ransomware payouts are down. Data-theft extortion is the surviving business model, and the marginal cost of sending a person in to bridge a gap (recovering a clean session, planting a hardware key, capturing camera footage of an admin’s PIN entry) is worth it when the payout is six or seven figures per victim. The brute-force economics of large-scale credential spraying still work for botnets. For high-touch extortion of named firms, in-person presence pays better.

Cybersecurity Trust Boundaries Are Breaking In More Than One Place

UNC3753 is the cleanest example of the week, and it sits inside a broader pattern. Meta confirmed today that 20,225 Instagram accounts were hijacked through its AI-powered support tool. Attackers used the chatbot to trigger password resets without going through the normal recovery flow. The trust boundary that broke was the one between conversational interface and authorization action. OpenAI’s newly broadened Lockdown Mode for ChatGPT is a tacit admission that prompt injection isn’t getting solved in the model layer; the fix is to restrict what the model can reach at all.

Microsoft, separately, announced that Visual Studio Code will now wait two hours before auto-updating extensions. Two hours won’t catch a determined supply-chain attacker. The signal is different: even Microsoft now treats “verified publisher” as an insufficient claim and is buying time for community detection. Three different incidents this week, three different trust assumptions failing in plain sight. Reception desks. AI support agents. Signed package updates. The common thread is that the entity sitting opposite you might be doing exactly what they appear to be doing, and that no longer means you should let them act.

What To Change This Week

The defensive answer is mostly unglamorous. You need to extend incident response coverage to physical access events, treat AI-facing identity actions as Tier 0 surface, and stop assuming that “auto-update from a trusted publisher” is safe by default. Threat detection content has to include physical-side signals: badge anomalies, unmatched visitor logs, off-hours building access correlated with help-desk call records. Most SIEM deployments don’t ingest any of this today.

Concrete steps your team can take this week:

• Pull the last 90 days of visitor logs and cross-reference against help-desk call records. Visitors present without a scheduled meeting, or vendor visits without a ticket, are worth a follow-up.
• Run a tabletop exercise where the inject is “an attacker called HR yesterday and is in reception now.” Most teams have rehearsed the phone half. Almost none have rehearsed the in-person half.
• Restrict help-desk actions that can be triggered by inbound calls. Password resets, MFA enrollment changes, and session resets should require out-of-band callback to a known number.
• Disable extension auto-update on developer fleets, or pin to a delayed channel. The two-hour VS Code window is a floor.
• Apply brute-force controls and rate limiting on every authentication surface that touches the internet, including AI support endpoints if you operate any.

Security hardening for the physical perimeter is going to feel foreign to teams that have spent a decade tuning EDR. Walk the building. Watch which doors get propped open at lunch. Ask whether your guards can actually pull badge access logs in the next ten minutes if you need them to. These are operational questions, not vendor questions, and most threat-protection budgets won’t help you answer them. Tools like IPBan and IPBan Pro stay a baseline on the network-side surface; they won’t stop a vishing crew that walks through reception, but every control you remove from the easy-wins list increases the pressure elsewhere.

Defense in depth is the only honest answer here. No single control catches everything. The point of this week is that “everything” got larger, and your IR playbook has to grow to match.

Sources

• UNC3753 Used Vishing and Physical Intrusions in U.S. Data Theft Extortion Campaign
• Over 20,000 Instagram accounts stolen in Meta AI support hack
• OpenAI Rolling Out ChatGPT Account Security Controls
• VS Code Adds 2-Hour Extension Auto-Update Delay to Limit Supply Chain Attacks