Vishing campaign abuses Microsoft Teams to give attackers a foothold in company networks
Unit 42 details 'Spring Ring', a vishing campaign using fake IT support on Microsoft Teams to reach 150+ employees at 10+ companies.
Palo Alto Networks Unit 42 documented 'Spring Ring', a voice-phishing campaign that ran January to April 2026, using 26 attacker identities and fake Microsoft 365 tenants such as 'ITProtectionDepartment' to impersonate internal IT support on Microsoft Teams. One path used Quick Assist or downloaded remote-support tools to run an obfuscated PowerShell script that disabled malware scanning before contacting C2; the other delivered a cloud-hosted file triggering browser hijacking, SMB internal network scanning, and a PetitPotam NTLM relay attempt against domain controllers to gain domain-level privileges. Both intrusion attempts were blocked before attackers reached their objectives. Collaboration-platform phishing alerts rose to 42% of Unit 42's telemetry in early 2026, up from 30%.
- Attackers registered onmicrosoft.com tenants like 'ITProtectionDepartment' to impersonate internal IT departments.
- 26 distinct attacker identities conducted chats and calls targeting 150+ employees at 10+ companies.
- PetitPotam NTLM relay aimed to make domain controllers authenticate to attacker machines for domain-level privileges.
- Collaboration-platform phishing alerts rose from 30% to 42% of Unit 42's telemetry in early 2026.
- Successful vishing calls typically lasted 10 to 15 minutes.
- ATT&CK
- T1598.002 Spearphishing VoiceT1219 Remote Access SoftwareT1059.001 PowerShellT1046 Network Service DiscoveryT1187 Forced Authentication
- Vendors
- Palo Alto NetworksMicrosoft
- Threat actors
- Spring Ring
- Malware
- Obfuscated PowerShell script
- Victims
- 10+ companies
- Organizations
- Unit 42Palo Alto NetworksMicrosoft
- Countries
- US
From the original article
2 min read at helpnetsecurity.com
A coordinated voice-phishing (vishing) campaign, named Spring Ring, used fake IT support accounts on Microsoft Teams to trick employees into installing malware or granting remote access to their computers, according to Unit 42, Palo Alto Networks’ threat intelligence team. The campaign ran between January and April 2026 and reached more than 150 employees at more than 10 companies in different industries.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.