Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A Microsoft Teams voice-phishing campaign leveraging Quick Assist, a remote administration tool, was tracked in September 2025. The campaign uses help desk scams to gain initial access, followed by user group enumeration and the execution of a PowerShell script to download a command and control payload. The attack employs AMSI bypass, encrypted communications, and a web-socket remote access trojan. Multiple Microsoft 365 tenants with IT-related subdomains were used, along with various IPs and domains for C2 infrastructure. The campaign shows similarities to Storm-1811 and PhantomCaptcha activities, suggesting a complex cybercrime ecosystem. The attackers' ultimate goal may be ransomware deployment, although observed attempts were successfully blocked.

The 'Quick, You Need Assistance!' campaign is a sophisticated voice-phishing attack leveraging Microsoft Teams to socially engineer targets into initiating remote sessions via Quick Assist, a legitimate Microsoft remote administration tool. The attackers impersonate help desk personnel to gain initial access, exploiting user trust to bypass technical barriers. Once access is granted, they perform user group enumeration to map the environment and execute PowerShell scripts that download and deploy a command and control (C2) payload. The payload includes a web-socket based remote access trojan (RAT), enabling persistent, encrypted communications with the attackers' infrastructure. To evade detection, the campaign uses AMSI (Antimalware Scan Interface) bypass techniques, which allow malicious PowerShell scripts to run without triggering endpoint protection alerts. The attackers operate multiple Microsoft 365 tenants with IT-related subdomains to lend legitimacy and diversify attack vectors, alongside a broad range of IP addresses and domains for their C2 servers. The campaign shares tactics and infrastructure similarities with known cybercrime groups Storm-1811 and PhantomCaptcha, suggesting it is part of a larger, complex cybercrime ecosystem. While ransomware deployment is suspected as the final objective, no successful ransomware infections have been observed, indicating effective defensive measures so far. Indicators of compromise include specific IP addresses and domains linked to the campaign, as well as URLs hosting malicious PDF files used as decoys or additional payload delivery mechanisms. The attack chain relies heavily on social engineering, PowerShell scripting, and abuse of legitimate remote assistance tools, highlighting the need for combined technical and user-focused defenses.

Detailed information about Quick, You Need Assistance!. Get real-time updates, technical details, and mitigation strategies.

Quick, You Need Assistance! - Live Threat Intelligence - Threat Radar | OffSeq.com

Quick, You Need Assistance!

Threats Tagged 'voice-phishing'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'voice-phishing'

Lead Pen Test Professional