{"success":true,"data":{"id":"intercom-zendesk-ai-ticket-phish","label":"Fake Intercom / Zendesk / Freshdesk support ticket notification with account-suspension urgency phishing","description":"Fake Intercom / Zendesk / Freshdesk AI-generated support ticket notification with account-suspension urgency phishing. Customer support platforms generate automated ticket notifications that look official and are habitually clicked by users. Attackers impersonate these platforms sending fake \"Ticket #XXXX requires your urgent response — failure to reply will result in account suspension\" or \"Your Zendesk ticket requires identity verification to proceed.\" The phishing email mimics the support platform's notification format and links to a credential-harvesting page. In 2026, attackers increasingly use LLM-generated ticket content that passes grammar filters and looks contextually appropriate. The signal fires when: (1) body references a support platform brand (Intercom, Zendesk, Freshdesk, Freshservice, HubSpot Service, ServiceNow, Help Scout, etc.) AND (2) ticket-response urgency or account-suspension threat is present AND (3) sender is NOT from intercom.com, zendesk.com, freshdesk.com, or other trusted support platform domains AND (4) no List-Unsubscribe or In-Reply-To header. Source: GC1 R13 council #8; Proofpoint Zendesk impersonation 2025; Cofense Intercom phishing Q1 2026.","tier":"danger","category":"phishing","isThin":false}}