SECURITY researchers have highlighted a vishing campaign, dubbed the Spring Ring, that targets Microsoft Teams and has affected more than 150 employees across 10 or more companies between January and April 2026. The operation relies on attackers using external Microsoft Teams accounts to initiate direct voice contact, impersonating IT help desk staff.
The tactic bypasses typical email filters by exploiting trusted collaboration channels and social engineering, with live voice calls designed to establish trust and coerce recipients into enabling remote access or downloading malware. Analysts from Palo Alto Networks Unit 42 and KnowBe4 describe the approach as a notable shift in enterprise social engineering.
There are two delivery paths described. In the first, victims are steered to run legitimate tools such as Quick Assist after controllers gain remote access, enabling basic system enumeration and the deployment of an obfuscated remote access Trojan that disabling the Antimalware Scan Interface and encrypting data.
In the second, targets are directed to a tailored cloud storage link leading to a malicious executable that triggers browser hijacking, a hidden Edge instance, sideloaded extensions, and Python-based internal network discovery, potentially followed by an NTLM relay attack to gain domain access. The attackers’ identities remain unidentified, though security teams consider it a coordinated, scalable operation conducted by cybercriminals rather than a known state actor.
Responders are urged to refine IT support verification, restrict unsolicited external chats in Teams, and heighten behavioural monitoring for rapid shifts from chats to voice calls and unusual remote-management activity. The report cites ongoing security investigations and references KnowBe4 and Unit 42 as primary sources. CVE-2026-85046 is listed in association with related threats from the period.