Hackers Weaponize Microsoft Teams Help Desk Calls for Malware and Network Lateral Movement
Attackers are exploiting Microsoft Teams' external communication features to impersonate IT support and trick employees into granting remote access or executing malware.
Attackers are turning Microsoft Teams help desk calls into an entry point for malware and network compromise. A campaign tracked as Spring Ring used external accounts that resembled internal IT support to chat with employees, then call them and press for remote access or software execution. The activity ran from January through April 2026 and approached more than 150 employees at at least 10 organizations. Its danger lies in the human element: a familiar sounding technician and a live conversation can make an unexpected request feel urgent and legitimate.
Analysts at Unit 42 identified the operation after detecting suspicious chat creation across multiple Microsoft 365 tenants, uncovering 26 distinct attacker identities. Palo Alto Networks stated that the group did not exploit a flaw in Teams. Instead, it abused external communication features and the trust users place in workplace collaboration tools. The campaign shows why Teams impersonation deserves the same scrutiny as email phishing. Attackers can adjust their story during a call, persuade a victim to run a remote support utility, and quickly move from a single workstation toward systems that control an entire network.
Spring Ring began with a one-to-one Teams chat from attacker-controlled .onmicrosoft.com tenants. The accounts carried authoritative display names such as help desk, IT assistance, or support staff, while some used names of real people to make the contact appear more credible. After a chat request, the operator placed unsolicited voice calls, sometimes leaving voicemails and repeatedly trying different targets. Successful conversations commonly lasted 10 to 15 minutes, giving the caller time to guide an employee through steps that would normally trigger suspicion in a written message.
In Campaign A, the fake technician persuaded victims to launch Quick Assist or download remote monitoring and management software. Once remote control was granted, the intruder checked the host and domain, then used PowerShell to retrieve an obfuscated remote-access trojan from its infrastructure. This method closely echoes a recent Microsoft Teams phishing campaign in which fake support staff pushed malware through the collaboration service. It also reinforces a basic rule: employees should independently verify an unexpected support request using a known company contact, never the caller's instructions.
Campaign B used a tailored cloud-hosted executable whose name included the target company and employee. The program copied itself into the Temp directory, created vhlp-.exe and scnr-.exe components for persistence, and launched a hidden Microsoft Edge process that loaded a sideloaded extension. The attackers then used Python to scan internal systems over SMB and generate NTLM traffic toward the domain controller. They attempted PetitPotam, a technique intended to force the controller to authenticate to an attacker-controlled machine, where that authentication could be relayed for domain-level access.
The attempted takeover was blocked, but the sequence illustrates how a help desk call can become a serious identity attack. Readers following Teams helpdesk impersonation scams will recognize the same reliance on external accounts and a convincing support pretext. Organizations should limit external Teams chats to genuine business needs, flag a rapid chat-to-call shift, and investigate unusual remote-tool launches, cloud downloads, and SMB activity.
Security teams should also watch authentication events involving domain controllers, an issue explained in coverage of MITM6 and NTLM relay. User education must be specific: IT staff should never ask workers to install unapproved tools or grant screen control after an unsolicited call. Combining that policy with behavioral monitoring and review of Teams audit data can catch the chain early, as outlined in reporting on external collaboration feature abuse.
The trusted communication platforms are now being used as a route to domain-level exploitation. The immediate defense is simple: stop, verify the request out of band, and report the external account before any tool is opened. That approach reduces the chance that an attacker can turn a routine Teams exchange into a costly enterprise-wide incident overnight.
The Spring Ring campaign, active from January to April 2026, specifically leveraged Microsoft Teams by creating external tenants with names mimicking internal IT departments to trick employees. Attackers used fake IT support accounts to initiate calls, guiding victims toward installing malware or granting remote access, with two distinct attack paths identified: one involving Quick Assist and PowerShell scripts, and another using cloud-hosted files and PetitPotam for NTLM relay attacks.