A coordinated vishing campaign called Spring Ring exploited Microsoft Teams by creating fake IT support accounts designed to impersonate internal teams, targeting employees across more than 10 companies between January and April 2026. Attackers contacted over 150 employees through these fraudulent accounts, attempting to trick them into installing malware or granting remote access to their systems. The campaign demonstrates how legitimate collaboration platforms can be weaponized for initial network compromise when attackers craft convincing social engineering pretexts.
Read full article at Help Net Security ↗The most common way into a company last year was to ask. A web page tells the visitor to prove they are not a robot. While they read the instructions, it quietly places a command on their clipboard. Then it talks them through opening a terminal and pasting it in. The technique is called ClickFix, and it was the most common initial access method Microsoft’s team observed last year, accounting
Threat actors are spoofing user-agent strings to impersonate AI crawlers from OpenAI, Anthropic, Google, Perplexity, and other companies while scanning websites for exposed credentials and configuration files. According to GreyNoise research, attackers exploit the fact that web requests are not authenticated by their user-agent declarations alone, making it trivial to forge legitimate-looking crawler identities. This technique allows adversaries to blend malicious reconnaissance traffic with legitimate AI indexing activity.
The Spring Ring campaign exploits Microsoft Teams as a vector for voice phishing attacks aimed at enterprise environments, with attackers using social engineering to gain access to sensitive systems. Researchers at Unit 42 have documented how this threat group leverages voice-based deception to ultimately deploy malware and target domain controllers within targeted organizations.
Fraudsters are leveraging Microsoft Teams and other enterprise chat applications to conduct scams targeting Chinese victims, convincing them to transfer substantial funds. The exploitation of these widely-trusted business communication platforms has generated a surge in complaints, highlighting how scammers are adapting their tactics to abuse legitimate enterprise tools.