TLDR Tech / InfoSec
Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams
Threat actors are conducting 'Spring Ring' voice phishing campaigns targeting Microsoft Teams users. They register external .onmicrosoft[.]com tenants under false help desk identities, initiate chats, and then escalate to calls, deceiving victims into launching remote management tools. Post-initial access, attackers deploy payloads, including an obfuscated PowerShell RAT that disables AMSI and a Python-based execution chain attempting PetitPotam coercion against domain controllers. Mitigation strategies include restricting external Teams access by default, blocking known payload hashes, and monitoring for rapid chat-to-call sequences originating from commercial VPN nodes.
Read the full story