Fake IT Workers Target Financial Firms, Google Warns

June 6, 2026 - 04:56

Google's cybersecurity team issued a warning on Friday that data theft extortion groups are actively targeting professional services firms, including legal and financial companies. These attackers pose as legitimate IT support workers to gain access to sensitive systems and steal financial data.

The scheme works by tricking employees into believing they are speaking with real IT staff. The fake workers request login credentials, remote access, or installation of software that gives them control over company networks. Once inside, they exfiltrate confidential client information, bank records, and legal documents.

Google's threat analysis group noted that these attacks have become more sophisticated. The criminals research their targets in advance, using public information to sound convincing. They may reference real company projects or use names of actual employees to build trust.

The warning highlights a growing trend where cybercriminals shift from simple ransomware to extortion-based attacks. Instead of just locking files, they steal data and threaten to release it unless a ransom is paid. Professional services firms are particularly vulnerable because they handle large volumes of sensitive financial and legal information.

Google recommends companies implement strict verification procedures for any IT support requests. Employees should be trained to never share passwords or grant remote access without confirming the request through official channels. Multi-factor authentication and monitoring for unusual login patterns can also help detect these attacks early.

The advisory comes as more businesses rely on remote IT support, creating opportunities for impersonators. Security experts urge firms to review their access policies and ensure all external IT vendors are properly vetted.