THE 'Spring Ring' operation is a coordinated campaign targeting at least 150 Microsoft Teams users through voice phishing (vishing) attacks. Conducted between January and April, it exploits trusted collaboration platforms to install remote monitoring tools and malware. Attackers, posing as legitimate IT support, create fake chats and initiate calls to coerce victims into granting remote access or executing malicious software.
Researchers note that vishing incidents have doubled in 2026, highlighting a shift towards social engineering tactics. The operation demonstrates the increasing need for organizations to adapt their security measures and educate employees about risks associated with unsolicited communications in collaboration platforms.