When Help Desks Hurt: How Freshdesk Credential Compromises Become a Silent Breach Vector

In our ongoing analysis of triage systems such as Zendesk, Freshdesk, Zoho, and Jira, we continue to uncover how customer service platforms—essential tools for modern business—can unintentionally act as gateways for cyberattacks. These platforms, often outsourced or cloud-managed, are frequent entry points for infostealer malware targeting employees, partners, and customers alike.

This article focuses specifically on Freshdesk, a widely adopted support system, by examining credential compromises linked to its use across dozens of organizations. Our investigation is supported by Infostealers.info—an open-source intelligence (OSINT) platform that aggregates credential logs, metadata, and infection patterns from infostealer malware campaigns. It enables cybersecurity teams and investigators to track compromised identities, understand exposure surfaces, and connect seemingly isolated infections to broader threat actor ecosystems.

Top Organizations Compromised via Freshdesk

Top Compromised Freshdesk URLs

The table below outlines the most affected Freshdesk subdomains and login paths, based on the volume of infostealer-related infections. This data provides actionable insight for red-teams and defenders prioritizing risk exposure across third-party help desk platforms.

Freshdesk Compromises by Email Provider

The chart below highlights the distribution of Freshdesk login compromises based on the associated email provider. This breakdown offers insight into which providers are most commonly linked to infostealer infections involving Freshdesk portals. The prevalence of certain providers may reflect user base size, password reuse habits, or regional adoption trends—all of which can inform targeted security measures and awareness efforts.

Risk Exposure Case Study I: RADIANCE Energy (IKAROS Solar)

RADIANCE Energy, formerly IKAROS Solar, is a European solar power leader that develops and operates photovoltaic systems. They rely on Freshdesk for customer support. Through Infostealers.info, we identified two compromised emails associated with ikarossolaresc.freshdesk.com—one linked to a former employee and another still active. By pivoting on the latter’s stealer log, we surfaced additional personal and potentially sensitive data, illustrating the downstream risk of support portal compromise.

Risk Exposure Case Study II: Compromised Bank Employees

Infostealer infections tied to Freshdesk portals used by financial institutions reveal direct risk to bank personnel. By tracing login emails, we confirmed several banks had employee credentials compromised. In some cases, an extra security layer appeared via integration with third-party cybersecurity firms, showing mixed levels of defense maturity. A full table of affected financial institutions follows below.

Risk Exposure Case Study III: Visma/Zetech & Customer Intel Leakage

Visma, a major Norwegian software firm, acquired Zetech in 2020 to expand their HR cloud offerings in Latin America. However, our analysis reveals 54 compromised logins to zetechsa.freshdesk.com between December 2022 and June 2025. While most M&A due diligence overlooks credential leakage, infostealer data revealed exposure not only for internal staff—but also for customer organizations.

Identified client emails included:

• Farmacias Central Oeste (Argentina)
• MGM Australia Limited (Australia)
• Los Soles Internacional (Argentina)
• Agired (Uruguay)

This case underscores a key insight: infostealer logs are not just a cybersecurity problem—they’re also a competitive intelligence and M&A risk.

Key Takeaways from Infostealers.info

Infostealers.info goes beyond raw breach data—it uncovers patterns of compromise, exposure points, and human error across organizations. By aggregating credential logs, metadata, and infection timelines, it empowers investigators and cybersecurity teams to:

• Map risk surfaces across support systems like Freshdesk, Zendesk, and other help desk systems
• Reveal insider exposure, supply chain risk, and customer intel leaks
• Trace repeated infections linked to poor password hygiene or shared infrastructure.