THE Spring Ring vishing campaign involves cybercriminals targeting over 150 employees across various companies through malicious Microsoft Teams chats between January and April 2026. The attackers impersonate IT help desk staff to deceive individuals into granting remote access or downloading malware. Using external Microsoft Teams accounts, they engage in direct voice calls that exploit the credibility of voice communication over standard emails, which are more closely monitored.
Two main tactics for executing the attack include instructing victims to run legitimate support tools or guiding them to malicious cloud storage links that download harmful executables. The campaign showcases a significant rise in collaboration tool abuse, as the attackers leverage weaknesses in enterprise identity verification. Organizations are urged to tighten external communication controls, verify IT support requests, and enhance monitoring for suspicious activities to mitigate such threats.