Voice phishing moves into enterprise chat
Unit 42 has detailed a campaign it calls Spring Ring, a Microsoft Teams-based voice phishing operation observed between January and April 2026. The company says attackers used external Teams accounts to pose as IT help desk personnel and approached more than 150 employees across at least 10 companies. The reported goal was not limited to stealing credentials: some victims were pushed toward remote access tooling, custom malware or activity aimed at domain-level compromise. Unit 42 also says it has no evidence that Microsoft Teams itself was compromised or affected by a product vulnerability in this campaign.What Unit 42 says Spring Ring did
Spring Ring used enterprise collaboration software as the first contact point, according to Unit 42's report published Aug. 31, 2026. Attackers created Microsoft Teams chats from external accounts, presented themselves as support staff, then moved quickly into voice calls where social pressure could replace a malicious email link as the main lure.The campaign matters because it shows how phishing can shift from inboxes to tools employees already use for internal work. Unit 42 says the attackers targeted more than 150 individual employees across more than 10 tenants and multiple industries. Many calls were missed or lasted only seconds, but successful calls often ran 10 to 15 minutes, giving the caller time to steer the victim through remote access or payload delivery.
The report describes this as a coordinated social engineering operation rather than a software exploit. That distinction is useful for defenders: patching is not enough when the weak point is an apparently normal chat and a convincing voice call.
Impersonation relied on external Teams identities
The core deception was familiar, but the delivery channel was newer. Unit 42 says the attackers used external Microsoft Teams accounts with display names and tenant names designed to resemble help desks, IT assistance teams, support staff or internal infrastructure groups.Investigators initially identified 26 distinct identities approaching targets across different organizations after monitoring alerts for suspicious Teams chat creation. The report says many accounts used external .onmicrosoft.com tenants with authority-signaling words such as internal, certified, network or infrastructure. In some cases, the attackers also used partially redacted personal names that matched legitimate industry personnel, though Unit 42 says that did not indicate those real accounts were compromised.
This tactic takes advantage of a trust gap inside collaboration platforms. Employees may treat a direct chat or call as more internal than email, especially if the message appears to come from a help desk persona and the attacker moves rapidly from text to audio.
Two attack paths raised the potential impact
Unit 42 describes two observed campaign paths that began with the same Teams lure but diverged after the call. In one path, the caller attempted to persuade the victim to run remote monitoring and management tooling, then used that access to move toward malware delivery. In the other, the victim was directed to attacker-controlled cloud infrastructure tailored with organization and user references.The first path followed a bring-your-own-tool pattern: a victim was guided toward remote support software, after which the attacker attempted host and domain discovery and malware execution. Unit 42 identifies the malware as an obfuscated PowerShell-based remote access Trojan, but the important defensive takeaway is simpler: a support call that results in unexpected remote-control activity can become an endpoint compromise attempt.
The second path was more customized and more dangerous for the wider organization. Unit 42 says the execution chain involved staged malware, browser-related activity and internal authentication coercion that attempted to reach a domain controller through an NTLM relay technique. The reported domain-takeover attempt was blocked, but the sequence shows how a voice call to one employee can become a route toward privileged infrastructure.
Detection depends on behavior, not only links
Spring Ring is difficult to reduce to one bad URL or one attachment. Unit 42 says detection depends on profiling how external identities interact with an organization: rapid one-to-one chat creation, a quick move to unsolicited audio calls, repeated attempts against several users and unusual use of remote support tools by employees who do not normally need them.The report also notes that attackers often cycled through targets, sometimes leaving voicemails before making contact. Source IP addresses often originated from commercial VPN services, according to Unit 42, which makes location-based assumptions less reliable. For defenders, the signal is the sequence: external tenant, IT-themed persona, fast voice call, pressure to grant access or open a tailored file.
Practical controls follow from that sequence. Organizations can review external chat policies, train staff to verify unexpected help desk calls through a known internal channel, restrict unnecessary remote access tools and monitor for collaboration-platform events that precede endpoint anomalies. These measures are defensive and process-heavy, but they address the point of attack more directly than link filtering alone.
The Microsoft Teams angle needs careful reading
The report does not say Microsoft Teams was breached. Unit 42 explicitly states it has no evidence of a compromise or vulnerability in Microsoft's product related to Spring Ring. The campaign instead abused legitimate communication features and external identities to create a convincing support scenario.That matters for risk assessment. The issue is not that a collaboration platform is unsafe by default; it is that attackers can operate inside legitimate SaaS workflows where employees expect fast interaction. Unit 42 frames this as part of a broader move away from traditional phishing toward trusted collaboration tools, where voice contact can make the lure more persuasive and less visible to normal email security processes.
For security teams, the implication is to treat identity and collaboration telemetry as part of the security perimeter. A new external chat that immediately turns into a support call should be visible to defenders, especially if it is followed by remote-control activity, downloads from unfamiliar cloud storage or unusual authentication traffic.
Conclusion
Spring Ring is a reminder that social engineering adapts to where work happens. Unit 42's findings show attackers using Microsoft Teams chats and voice calls to impersonate IT support, then pushing selected victims toward remote access, malware or activity that could threaten domain infrastructure.The strongest lesson is operational rather than dramatic. Enterprises should not treat collaboration-platform messages as automatically trusted, even when they sound internal. Verification paths for support calls, limits on external communication, monitoring of chat-to-call patterns and scrutiny of unexpected remote support sessions can reduce the chance that a short voice call becomes a larger compromise.
Sources
Editorial Team - CoinBotLab
