A recent article released by the Palo Alto Threat Research Center found that, between January and April 2026, a coordinated effort by threat actors was successful in launching vishing attacks using Microsoft Teams accounts to compromise companies across multiple industries.
The threat actor uses an external Teams account and creates a chat “using identities designed to mirror legitimate internal support units.” Usually these include names like help desk, IT support, or something else that makes the user believe the chat is coming from an internal IT support professional. The chat has a sense of urgency that something needs to be done on the user’s computer. The threat actors then call the victim and, if the user picks up, the scam commences. The threat actor then guides the employee through steps to allow remote control or to download malicious malware. If the caller doesn’t pick up, the threat actor calls back multiple times, scaring the user into believing it is urgent.
Once in the system, the threat actor has full control over the user’s access and can exfiltrate data, deploy ransomware, and start a ransomware attack.
Palo Alto has dubbed this attack as “Spring Ring.” It found that between January and April 2026, Spring Ring targeted many organizations across different industries, and more than 150 individual employees were called. In addition, this coordinated attack shows that threat actors are using legitimate tools to lull victims into believing the chats and calls are real.
It is crucial to be aware of the evolving nature of threats, including social engineering and the rise of vishing attacks, to understand that threat actors are using legitimate tools and to distrust any request for remote access to your computer. When in doubt, ignore the chat, and call your IT professional directly to a known number. If IT is really trying to get in touch with you, they will be very happy that you are calling them directly rather than falling victim to a vishing scheme.