MalwarePublished 30 Jul 2026

Microsoft Teams vishing attacks lead to Chaos ransomware attacks

Source Bleeping Computer

Description

Threat actors are impersonating IT support staff in Microsoft Teams calls to gain remote access to corporate devices and deploy Chaos ransomware in attacks targeting North American organizations. [...]

Impact

Successful attacks result in unauthorized remote access to corporate devices, enabling attackers to deploy backdoors and establish persistence. This access facilitates lateral movement within networks and the deployment of Chaos ransomware, which encrypts files and threatens data leakage. At least three organizations suffered ransomware attacks, with one incident involving rapid encryption within 17 hours and likely data theft prior to encryption. The campaign disrupts business operations and exposes sensitive data to extortion risks.

Defensive guidance

Organizations should be aware of this social engineering threat vector via Microsoft Teams and educate employees to verify IT support requests independently. Blocking or monitoring the use of unauthorized remote support tools like RemSupp may reduce risk. Implementing strict application allowlisting and restricting remote access tools can help prevent unauthorized sessions. Since this is a social engineering attack leveraging legitimate collaboration tools, user training and verification processes are critical.

References

bleepingcomputer.com/news/security/microsoft-teams-vishing-attacks-lead-to-chaos-ransomware-attacks/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 30 Jul 2026, 17:22 UTC

References

Community reviews

Related threats