Loading story…
Microsoft and Sophos reported separate but closely aligned social-engineering campaigns in which attackers impersonated IT support staff over Microsoft Teams, phone calls, and related pretexts to trick employees into granting remote access through Quick Assist or other support tools. Microsoft attributed its activity to Storm-1811, which used vishing and email-bombing to gain access, steal credentials through EvilProxy, and deploy tools including Qakbot, Cobalt Strike, ScreenConnect, NetSupport Manager, OpenSSH tunneling, and SystemBC before rolling out Black Basta ransomware with PsExec. Microsoft said it suspended malicious Teams accounts and tenants involved in the impersonation activity and added stronger Quick Assist warnings and trust indicators.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
Gurucul released technical details on the STAC4749 Microsoft Teams vishing campaign, including malicious domains, URLs, IP addresses, file hashes, and detection queries for hunting related activity. The report also described the attackers' use of a custom loader, backdoor, and modular post-exploitation tooling before Chaos ransomware deployment.
Expel reported first observing the newly observed MiniShai Hulud worm in May 2026, describing it as targeting the npm and PyPI ecosystems. The worm drove a spike in cloud supply chain incidents that month and was said to resemble, but not be connected to, the original Shai Hulud attack.
Sophos observed that at least three STAC4749 intrusions culminated in Chaos ransomware deployment, including one case that progressed from initial access to encryption in under 17 hours.
Sophos reported that a Microsoft Teams voice phishing campaign tracked as STAC4749 targeted dozens of organizations in Canada and the United States between February and June 2026 by impersonating IT support staff and persuading users to grant remote access.
Orange Cyberdefense said it observed a series of social-engineering attacks in December 2024 that began with email bombing and then shifted to Microsoft Teams outreach from accounts impersonating IT or help desk staff. In early December, it linked multiple incidents involving DarkGate and Lumma Stealer to the broader campaign and noted tradecraft overlaps historically associated with Black Basta operators.
Rapid7 said a Black Basta-linked social-engineering campaign resurfaced in early October 2024, using email bombing followed by Microsoft Teams impersonation to push Quick Assist, AnyDesk, TeamViewer, ScreenConnect, Level, or OpenSSH-based access. The report also documented updated credential-harvesting and payload delivery tradecraft, including a rundll32-launched DLL harvester and follow-on Zbot/Zloader or DarkGate malware.
Microsoft said it suspended malicious Teams accounts and tenants involved in the impersonation activity and was improving Quick Assist warnings and trust transparency in response to the campaign.
By late May 2024, Storm-1811 had expanded its social engineering activity to Microsoft Teams messages and calls impersonating help desk or IT staff to trick users into granting remote access.
Rapid7 reported that since late April 2024, attackers had targeted multiple MDR customers with email bombing followed by phone calls impersonating internal IT staff to obtain remote access via AnyDesk or Windows Quick Assist. After access, the actor used batch scripts, renamed OpenSSH components, registry Run-key persistence, credential harvesting, and in some cases attempted NetSupport, ScreenConnect, SMB lateral movement, and Cobalt Strike deployment; Rapid7 assessed the activity as consistent with Black Basta operators.
Microsoft Threat Intelligence reported that the financially motivated group Storm-1811 had been abusing Quick Assist since mid-April 2024 as part of intrusion chains that led to credential theft, malware delivery, and follow-on Black Basta ransomware activity.
Trend Micro reported a social-engineering intrusion in which attackers used Microsoft Teams voice phishing while impersonating support personnel to gain access and facilitate DarkGate malware deployment. The report documented Teams-based vishing as an intrusion vector tied to DarkGate activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
13 references tracked. Mallory keeps watching after this page renders.
expel.com
Open sourcecyberveille.ch
Open sourcecyberveille.ch
Open sourcebleepingcomputer.com
Open sourcerapid7.com
Open sourcemicrosoft.com
Open sourcerapid7.com
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Black Basta affiliates used a multi-stage social-engineering campaign to breach corporate networks by impersonating IT support staff in **Microsoft Teams** and persuading employees to grant remote access through **Windows Quick Assist** and **AnyDesk**. Researchers said the attacks often began with email bombing to overwhelm targets, followed by Teams chats or calls from attacker-controlled external Entra ID tenants using names such as "Help Desk" or "support." In earlier incidents, the group similarly abused Quick Assist after contacting victims by phone, showing a consistent pattern of using legitimate remote-support tools to gain initial access. After access was established, the attackers deployed additional tooling including **ScreenConnect**, **NetSupport Manager**, **Cobalt Strike**, and **SystemBC**-linked payloads, while also using credential-theft and lateral-movement activity such as accessing **LSASS**, scanning internal hosts, and running **Impacket `secretsdump.py`**. ReliaQuest also observed malicious QR-code lures tied to domains such as `qr-s1[.]com` through `qr-s4[.]com`, and a VBS-based infection chain that contacted `179.60.149[.]194` to retrieve follow-on payloads. The activity was attributed to Black Basta with high confidence, with reporting indicating infrastructure and Teams activity linked to Russia, and defenders were urged to restrict external Teams communications, limit trusted domains, and improve Teams, email, and remote-access monitoring.
Aug 14, 2026
Attackers used **Microsoft Teams** to impersonate IT or helpdesk staff and socially engineer employees into granting access or executing malicious actions, turning collaboration tooling and trusted support workflows into the initial access vector. One report describes a compromise at an Italy-based consumer services company where a Teams meeting invite and screen sharing session led the victim to run a staged **PowerShell** chain that deployed **PhantomBackdoor**, a multi-stage **WebSocket-based** backdoor associated with earlier spear-phishing activity. The observed sequence included post-call PowerShell execution, device reconnaissance, and establishment of WebSocket command-and-control. A second report describes a similar **vishing** intrusion in which a threat actor posing as support staff called employees through Teams and, after multiple attempts, convinced one user to grant remote access through **Quick Assist**. The attacker then directed the victim to a spoofed credential-harvesting site, used a malicious **MSI** and sideloaded **DLL** to launch follow-on payloads, and established outbound C2. While the malware families and exact post-compromise chains differ, both accounts document the same operational pattern: **Teams-based social engineering**, abuse of legitimate remote assistance or user-guided execution, credential theft or payload staging, and transition to hands-on intrusion activity inside a corporate environment.
Jun 29, 2026
Sophos MDR reported two ransomware campaigns that combined **email bombing** with **voice phishing over Microsoft Teams** to gain initial access to targeted organizations. In the observed intrusions, attackers overwhelmed users with large volumes of emails and then contacted them through Teams while impersonating IT or help desk staff, using the confusion to persuade victims to grant remote access or follow attacker-directed steps. The activity highlights how adversaries are blending social engineering with trusted enterprise collaboration tools to bypass technical defenses. The campaigns were tied to ransomware operations and show a repeatable intrusion pattern in which attackers exploit user fatigue, trust in internal support workflows, and the widespread use of Microsoft 365 services. The reported tradecraft underscores the need for organizations to harden Teams and remote-support processes, verify help desk interactions through separate channels, and train staff to treat unsolicited support calls during email floods as suspicious, especially when they involve requests for remote access, credential entry, or security tool changes.
Jul 12, 2026