An Inside Look at Voice Phishing Campaigns in Microsoft Teams

Between January and April 2026, the Spring Ring operation used external Microsoft Teams accounts to impersonate IT help desk staff and conduct voice phishing calls targeting employees at multiple companies. Initial attacks involved social engineering victims into running remote monitoring and management (RMM) tools or obfuscated PowerShell-based remote access Trojans (RATs). More advanced attacks transitioned to NTLM relay attacks against domain controllers using PetitPotam exploitation, enabling domain-level compromise. Two distinct campaigns were identified: Campaign A utilized RMM tools and PowerShell RATs, while Campaign B employed tailored cloud infrastructure to facilitate PetitPotam exploitation. The campaign demonstrates how trusted SaaS collaboration platforms can be weaponized to facilitate complex multi-stage attacks that exploit human trust and technical vulnerabilities in network authentication protocols.

The campaign enabled attackers to gain initial access by tricking employees into executing malicious tools, potentially leading to remote code execution and persistent access. Escalation to NTLM relay attacks and PetitPotam exploitation allowed attackers to target domain controllers, risking full domain compromise. This could result in significant organizational impact including data breaches, lateral movement, and control over critical infrastructure. The use of trusted collaboration platforms increases the likelihood of successful social engineering due to inherent trust in these services.

No official patch or fix applies directly to this social engineering campaign as it exploits human trust rather than a software vulnerability. Organizations should focus on user awareness training about voice phishing and social engineering tactics, independently verifying the identities of help desk personnel, and monitoring for unusual execution of remote management tools. Network defenses should include detection of NTLM relay attempts and PetitPotam exploitation. Review vendor advisories for Microsoft Teams and related infrastructure for any updates or mitigations. The vendor does not manage remediation for this threat since it is a social engineering campaign leveraging SaaS platforms.