55
30
Teams calls are about to get a lot harder to fake
Microsoft will roll out Brand Impersonation Protection in Teams Calling from mid-May 2026, warning users about suspicious inbound VoIP calls impersonating trusted brands.
Microsoft Teams Calling is gaining Brand Impersonation Protection, which evaluates inbound VoIP calls from first-time external callers for signs of brand impersonation and displays warnings before users answer high-risk calls. The feature rolls out from mid-May 2026 with completion expected by late May 2026, is enabled by default, and requires no administrative action. Users can accept, block, or end flagged calls, and alerts may continue throughout a call if suspicious activity persists. Microsoft recommends preparing helpdesk teams and updating security awareness materials ahead of deployment.
25
60
55
30
30
Week in review: cPanel vulnerability actively exploited, DigiCert breach, LinkedIn job scams
60
42
42
60
30
30
60
60
30
30
60
60
Impersonating IT support: how threat actors turn a remote session into enterprise-wide access
Microsoft details Teams IT-support impersonation campaigns deploying Node.js implants, AD reconnaissance, and WinRM lateral movement toward domain controllers.
Microsoft Threat Intelligence describes a human-operated campaign where attackers impersonate IT/helpdesk staff via Microsoft Teams external collaboration, talk users into granting remote sessions, and use RMM tools for interactive access. During the session they run PowerShell to silently install a malicious MSI that stages a portable Node.js runtime and obfuscated JavaScript implant for C2, executing follow-on payloads via rundll32. Operators then perform host and Active Directory reconnaissance, capture desktop screenshots, and pivot via WinRM on port 5985 to domain controllers and certificate authorities. The hands-on-keyboard chain, which can precede data theft and ransomware, blends into normal operations by relying on Teams, Quick Assist, msiexec, and Node.js; Microsoft shares hunting and mitigation guidance.
82
55
30
57
55
60
30
57
60
57
30
57
57
35
55
60
30
Week in review: 74k Fortinet firewall credentials stolen, Splunk Enterprise RCE under active attack
60
60
42
55