Security researchers at Palo Alto Networks’ Unit 42 have uncovered a voice-phishing campaign dubbed “Spring Ring” that impersonated IT help desk staff on Microsoft Teams in attempts to compromise corporate systems.
The researchers said the coordinated operation targeted over 150 employees across at least 10 organizations between January and April 2026. They also stressed that the operation did not exploit a flaw in Teams and they found no evidence that Microsoft services had been breached.
Spring Ring attackers initiated chats with employees via external Microsoft 365 accounts with seemingly authoritative onmicrosoft.com subdomains and display names, such as “IT help desk” or “support staff”. Some used the names of real industry professionals, although there is no indication that these individuals’ accounts were compromised.
Attackers typically concealed their locations using commercial VPN services. After making initial contact via chat, they made unsolicited voice calls to employees via Microsoft Teams.
Two distinct attack paths
Unit 42 identified two attack variants. In the first, attackers impersonating technicians tried to persuade employees to launch Windows Quick Assist or install other remote monitoring software used by IT support teams.
After gaining remote control of a device, the attackers enumerated the host and domain before using PowerShell to download an obfuscated remote access trojan. This malware tried to bypass Windows’ Antimalware Scan Interface and communicate with attacker-controlled infrastructure to retrieve additional payloads.
The second attack path directed targeted employees to cloud-hosted executables customized with the names of a targeted employee and their organization. After execution, the malware copied itself into the temporary-files directory, spawned additional copies, opened a hidden instance of Microsoft Edge and sideloaded a malicious browser extension.
The attackers then scanned internal servers over SMB and attempted a PetitPotam NTLM relay attack, which was designed to coerce a domain controller into authenticating to an attacker-controlled system, potentially allowing attackers to obtain domain-level privileges. Unit 42 said its Managed Detection and Response service blocked the attempted domain takeover.
Detecting and preventing Spring Ring attacks
Unit 42 highlighted some warning signs that could help organizations to detect Spring Ring attacks. These include:
- External tenants with suspicious IT-related names.
- Swift transitions from chat requests to unsolicited calls.
- The same external account contacting five or six employees within minutes.
- Connections originating from commercial VPN infrastructure.
- Unexpected use of Quick Assist or other remote-management tools.
- Employees accessing unfamiliar cloud-storage or file-hosting links.
The researchers also advised organizations to educate employees about unsolicited external communications and use behavioral monitoring tools to identify anomalous activity early.
