Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor

Since January 2026, a threat actor likely functioning as an initial access broker for ransomware operations has been targeting organizations through Microsoft Teams vishing attacks. Attackers impersonate IT helpdesk staff to convince victims to initiate Quick Assist remote sessions. Following initial compromise, PowerShell scripts deploy a Go-based backdoor called GoGRPC, which exists in four distinct variants: Lep, Giver, Pet, and Kind. These variants communicate with command-and-control infrastructure using gRPC over HTTP/2, an uncommon approach that helps blend malicious traffic with legitimate communications. Additional tools observed include BlindDoor backdoor, RevSocket and PyGRPC SOCKS proxies, S3Siphon data exfiltration utility, and RSOX Rust-based proxy relay. Recent campaigns show increased sophistication and selectivity, with heightened focus on corporate environments through enhanced PowerShell scripts capable of antivirus detection, domain controller fingerprinting, and system reconnaissance b...

• Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial AccessMalware2026-10-26
• 26th October · Threat Intelligence ReportBreach2026-10-26
• Cybersecurity in Christopher Nolan’s The Odyssey | Kaspersky official blogAnalysis2026-10-26
• Stray Cat, Open Doors: How k0t Wanders Through the Network EdgeCampaign2026-10-21
• Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress ExploitationCampaign2026-09-22