Vishing campaign abuses Microsoft Teams to breach corporate networks

Palo Alto Networks’ Unit 42 has detailed a coordinated voice-phishing campaign, dubbed Spring Ring, that abused Microsoft Teams to trick employees into installing malware or granting remote access. The campaign ran from January to April 2026 and targeted more than 150 employees across over 10 companies in various industries.

Attackers registered external Microsoft Teams tenants with names resembling internal IT departments, such as ITProtectionDepartment, and used fake technician identities to increase authenticity. Two attack flows were observed: one directing victims to remote-support software, the other sending a link to a malicious file hosted on cloud storage.

The second flow attempted an NTLM relay attack using PetitPotam to gain domain-level privileges. Both intrusion attempts were blocked by Unit 42. The researchers noted that phishing alerts tied to collaboration platforms accounted for 42% of all phishing alerts in their telemetry, up from 30% in the preceding four months.