Table of Contents
Key Takeaway
- 📞 The campaign: Unit 42, Palo Alto Networks’ threat intelligence team, documented “Spring Ring” — coordinated Microsoft Teams vishing in which attackers posed as internal IT support, hitting 150+ employees across 10+ companies between January and April 2026.
- 🎭 The trick: 26 distinct attacker identities operated fake Microsoft 365 tenants with trustworthy names like “ITProtectionDepartment,” then moved from friendly chat to a live voice call lasting 10-15 minutes.
- 🛠️ Two attack paths: one pushed victims into Quick Assist remote control and disabled Windows Defender via PowerShell; the other delivered a trojanized file that scanned internal networks and attempted a PetitPotam NTLM relay against the domain controller.
- 📈 The trend: collaboration-platform phishing alerts hit 42% of Unit 42’s telemetry in early 2026, up from 30% — chat and voice channels are now a primary phishing surface, not a sideshow.
- 🛡️ The fix is fast: restrict external Teams tenants, block Quick Assist by policy, train staff that IT never cold-calls through Teams — most defenses take under ten minutes to configure.
Microsoft Teams vishing no longer announces itself with a sketchy link — it arrives as a polite voice call from a technician whose tenant name looks exactly like your own IT department. Unit 42, Palo Alto Networks’ threat intelligence team, has documented a coordinated voice-phishing operation tracked as Spring Ring: 26 distinct attacker identities, more than 150 targeted employees at over 10 companies, fake help-desk personas complete with realistic tenant names, and two well-built intrusion paths that ended at domain-level privileges. Both intrusions were blocked before the attackers reached their objective — which makes this report rare: a full anatomy of an attack that security teams can study before their own turn comes. If you work in any company that runs Microsoft 365, the ten minutes you spend on this page is the cheapest security training you will get this year.
How the Microsoft Teams Vishing Script Actually Ran
The operation began with infrastructure, not phone calls. The attackers registered external Microsoft 365 tenants using the onmicrosoft.com format that every Microsoft 365 customer’s organization uses, giving their fake IT departments names engineered to sound internal: “ITProtectionDepartment,” “MandatoryNetworkMonitoring.” Unit 42 identified 26 distinct attacker identities behind the chat and call attempts — this was not one scammer with a headset but a coordinated Microsoft Teams vishing operation with staffing, targets, and rotation.
The approach followed a patient, human sequence. First a Teams chat request — easy to accept on a busy afternoon because Teams shows external messages with only subtle “external” labeling. Once the chat was accepted, the attacker placed a call. Many attempts were missed or lasted only seconds while the caller worked through a target list; successful calls ran 10 to 15 minutes. That duration is the tell of a real social-engineering operation: long enough to build rapport, establish urgency about a “security update” or “system monitoring requirement,” and walk the victim into the next step willingly.
The Unit 42 researchers were careful with an important nuance: threat actors frequently abuse or subvert legitimate products for malicious purposes, and none of this indicates that Teams itself is flawed or compromised. The collaboration platform is the channel precisely because it is trusted, corporate, and familiar — the same reason email worked for attackers for thirty years.
Path One: Quick Assist and the Disabled Antivirus
The first Microsoft Teams vishing campaign weaponized a tool that ships with Windows by default. The caller directed the victim to launch Quick Assist — Microsoft’s built-in remote-support application — or to download a remote-support tool, then requested control of the machine. From that moment the employee was watching their own computer being operated by someone else, narrated as routine IT maintenance.
Once connected, the attacker ran commands to enumerate the user’s group membership and confirm the domain — reconnaissance to establish what privileges this foothold carried. Then came the payload: an obfuscated PowerShell script that disabled Windows’ built-in malware scanning before reaching out to a command and control server. The sequence is worth internalizing because it inverts the usual malware story: no email attachment, no exploit, no zero-day — just a trusted application, a cooperative human, and ten minutes of phone conversation. Every technical control that followed, from the disabled Defender to the C2 beacon, depended entirely on that first human “yes.”
Path Two: The Company-Named File and PetitPotam
The second Microsoft Teams vishing campaign took a different route to the same destination. Instead of remote control, the attacker sent the victim a link to a file on cloud storage — named to include the victim’s own company and username, a detail that transforms a generic attachment into a plausible internal document. Running the file triggered a cascade: browser hijacking, scanning of the internal network over SMB, and an attempted NTLM relay attack using PetitPotam, a tool that coaxes a domain controller into authenticating to a machine the attacker controls.
That last step is the escalation that makes Spring Ring more than a help-desk scam. A successful NTLM relay against a domain controller can hand over domain-level privileges — the keys to the entire Windows environment, every file server, every mailbox. The attack chain ran from a friendly chat message to a near-total infrastructure compromise in a handful of human decisions. Unit 42 blocked both intrusion attempts before the attackers reached their objective, but the distance the attackers traveled — from stranger to domain-controller authentication attempt — is the measurement that should worry every network administrator reading this.
Collaboration Platforms Are the New Phishing Inbox
The scale behind the anecdote is the number that should reset security budgets. Phishing alerts tied to collaboration platforms accounted for 42% of all phishing alerts in Unit 42’s telemetry in the first four months of 2026, up from 30% in the preceding four months. The Microsoft Teams vishing surge has a simple mechanism: email filters have two decades of hardened defense, while Teams, Slack, and their siblings were designed for collaboration, not inspection — external tenant messages arrive with the same interface, the same corporate sheen, and far fewer guardrails.
The Philippine workplace makes this sharper, not softer. The country’s IT-BPM sector runs on Microsoft 365 and Teams around the clock — call centers, shared-services hubs, and BPO operations handling foreign clients’ systems are precisely the environment where a “MandatoryNetworkMonitoring” tenant and a polite technician can move laterally across accounts. The DICT and its National Computer Emergency Response Team have repeatedly warned about social-engineering attacks on Filipino organizations, and the pattern Spring Ring documents — trust in the platform, urgency in the voice, cooperation from the victim — defeats the specific instincts that make Filipino office culture warm: helpfulness to colleagues, deference to IT, reluctance to challenge someone who sounds busy and official. Our earlier coverage of the ToxicPanda banking malware showed the same psychology in consumer banking, and our analysis of Windows 11’s five-minute kernel protection setup covers the local-machine hardening side; Spring Ring shows the corporate-stack version of the same problem. For the help desks that anchor the first 72 hours after a data breach, Spring Ring is the prequel — the moment where the breach is still one refused phone call away.
Researchers’ closing warning deserves quoting in every IT department meeting: by using seemingly legitimate external tenants and professional vishing lures, attackers can target hundreds of employees across many industries with minimal friction. The economics are brutal — one operator with 26 identities can work a target list of hundreds for the cost of a Microsoft 365 trial tenant.
The Ten-Minute Defense Checklist
Unit 42 published full indicators of compromise — attacker-controlled domains, IP addresses, file hashes — that security teams can feed directly into blocklists and threat intelligence platforms. But the structural defenses matter more than the blocklist, because the next campaign will rotate infrastructure. First, restrict external access in the Teams admin center: limit which external domains can reach your users, and consider disabling external tenant chats for roles that never need them — the single most effective Microsoft Teams vishing control available today. Second, block or restrict Quick Assist and consumer remote-support tools by policy — there is no legitimate workflow that requires an employee to accept a cold-call remote-control request. Third, enforce that IT support tickets originate in the ticketing system, never in chat, and put that sentence in writing to every employee: a real IT department does not cold-call through Teams chat from an unfamiliar tenant. Fourth, brief the front line on the exact script documented here — external tenant, named technician, 10-15 minute call, remote-support request — because pattern recognition is the control that survives the next rebrand. Fifth, verify outbound NTLM exposure and patch domain controllers against PetitPotam-class relay attacks; Microsoft’s own guidance for Defender for Identity covers the hardening steps.
For employees — the people actually getting the calls — the rule is simpler than any policy document: never grant remote access or run files at the instruction of someone who contacted you first. IT can wait for a ticket; attackers cannot. That asymmetry is the entire defense.
The Spring Ring Microsoft Teams vishing campaign ended with both intrusions blocked, which is the good news. The durable news is the method: 42% of phishing alerts now arrive through collaboration platforms, the personas are professional, the tenants look corporate, and the calls last just long enough to feel routine. The voice on Teams that sounds helpful is not automatically human trustworthiness wearing your company’s colors — it might be identity 14 of 26, working through a list, waiting for one yes.
Frequently Asked Questions
What is the Spring Ring Microsoft Teams vishing campaign?
A coordinated voice-phishing operation documented by Unit 42, Palo Alto Networks’ threat intelligence team, in which attackers created fake Microsoft 365 tenants resembling internal IT departments and called employees via Microsoft Teams. It reached more than 150 employees at over 10 companies between January and April 2026, using 26 distinct attacker identities.
How did the Spring Ring attackers get into company networks?
Through two paths after winning the victim’s trust on a Teams call: one directed victims to grant remote control via Quick Assist or similar tools, then disabled Windows Defender with a PowerShell script and connected to a command-and-control server; the other delivered a company-named malicious file that hijacked the browser, scanned the network over SMB, and attempted a PetitPotam NTLM relay against the domain controller.
Why does Teams vishing work better than email phishing?
Because email defenses are mature while collaboration platforms are not built for inspection: external messages arrive in the same interface as internal ones, and a live voice call adds social pressure that a suspicious email never has. Unit 42 measured collaboration-platform phishing at 42% of all phishing alerts in early 2026, up from 30% in the prior period.
How can I tell if a Teams call is really from IT?
Check whether the request originated from your internal ticketing system, inspect whether the caller’s tenant is external to your organization, and remember that real IT staff never ask for remote control or password actions in response to a call you did not request. The Spring Ring Microsoft Teams vishing playbook collapses the moment a victim hangs up and verifies through the official help-desk channel.
What should IT administrators in the Philippines do about this threat?
Restrict external Teams tenants in the admin center, block Quick Assist and unauthorized remote-support tools by policy, train staff on the exact Spring Ring script, feed Unit 42’s published indicators of compromise into security tooling, and harden domain controllers against NTLM relay attacks. The DICT and its CERT advisories are the local reference point for reporting and coordination.
Does this mean Microsoft Teams is unsafe?
No. Unit 42 explicitly notes that attackers abuse legitimate products without the product being flawed or compromised. The risk is the human layer — trust extended across tenant boundaries — which is why configuration restrictions and staff training, not platform replacement, are the answer.
Financial Disclaimer
This article is provided for general information and educational purposes only. It does not constitute professional cybersecurity, legal, or financial advice. Threat details reflect third-party research findings at the time of writing and may evolve. Organizations should consult their security providers and official advisories, including those from the Department of Information and Communications Technology, when making security decisions.
