THE report outlines a series of voice phishing campaigns known as Spring Ring, which targeted over 150 employees across 10 companies via external Microsoft Teams accounts, masquerading as IT help desk personnel. The malicious actors used 'vishing' calls to persuade victims to install remote management tools or custom malware. The campaigns illustrate a shift in attack strategies as they exploit trusted collaboration platforms, transitioning from traditional phishing tactics.
Two distinct attack campaigns were observed, employing different methods for payload delivery, including remote monitoring tools and tailored malicious cloud executables. The report stresses the importance of user education and robust monitoring to identify and mitigate identity-based anomalies in social engineering attacks.