Criminals Pose as IT Support Inside Microsoft Teams to Take Over Company Networks
A hacking campaign called Spring Ring tricked more than 150 employees at ten-plus companies into handing over remote control of their computers, all through a fake Teams call from a fake help desk.
Key points
- Spring Ring attacked at least 150 Microsoft Teams users across more than 10 organisations between January and April 2025.
- Criminals posed as internal IT support staff, calling victims directly through Teams to trick them into installing remote-access software.
- A second, more dangerous attack variant attempted to seize control of an organisation's entire identity system, the directory that manages every user account.
- Vishing (voice-based phishing, where criminals impersonate someone trusted over a call rather than in an email) doubled in the first half of 2026, according to CrowdStrike.
- Palo Alto Networks' Unit 42 research team blocked the most advanced attack attempts before they caused lasting damage.
Your phone rings inside Microsoft Teams. The caller ID says "IT Help Desk." A friendly voice explains there is a security problem with your account and walks you through a quick fix. Fifteen minutes later, criminals have full control of your computer.
That is the Spring Ring playbook.
Researchers at Palo Alto Networks spent the first four months of 2025 tracking a coordinated campaign that hit at least 150 employees across more than 10 companies. The operation exploits the trust people place in their company's collaboration tools. We've been watching this vector develop: our piece on a phishing crew that hijacked a legitimate IT tool to seize more than 450 computers showed just how quickly remote-access abuse can scale.
How did the attack actually work?
Criminals created fake Teams accounts with names designed to look like official internal support: words like "Help Desk," "IT Assistance," or "Support Staff." They started a chat, then called. Successful calls ran between 10 and 15 minutes, according to Palo Alto Networks researcher Noam Sala.
The simpler variant convinced employees to open Windows Quick Assist, a built-in screen-sharing tool, or similar remote-management software, handing the criminals direct keyboard-and-mouse control. Once in, attackers ran basic reconnaissance before attempting to drop an obfuscated PowerShell backdoor. Endpoint protection blocked it.
The second variant was more ambitious. Victims were directed to download files from cloud storage that turned out to be malicious executables. Those executables established persistence, launched a hidden browser session, and installed a rogue extension before probing the internal network. The goal was a PetitPotam NTLM relay attack, which works by tricking a company's main user-account server (called a domain controller) into sending its credentials to a machine the criminals control. Pull that off and you can reset passwords across the entire organisation. Unit 42's monitoring service caught and blocked the attempt.
| Attack stage | What the criminals did | Outcome |
|---|---|---|
| Initial contact | Fake "Help Desk" Teams chat and call | Victim engagement |
| Vector 1 | Persuaded victim to share screen via Quick Assist | Blocked by endpoint protection |
| Vector 2 | Victim downloaded malicious executable from cloud link | Hidden browser and network probe launched |
| Final goal | PetitPotam relay attack against domain controller | Blocked by Unit 42 managed detection |
Should employees be worried?
Yes, but the fix is awareness, not technical expertise.
The entire attack rests on one assumption: that you won't question an unexpected call from someone claiming to be your own IT department. Denis Calderone, chief technology officer at Suzu Labs, is direct about it. Standard training built around "don't click the link" and "check the sender" doesn't prepare anyone for a live phone conversation. Organisations need to rehearse the real scenario so staff feel instinctive unease, what Calderone calls "getting your Spidey sense tingling," when an unfamiliar caller asks them to run software.
If an unexpected Teams call arrives from someone claiming to be IT support, verify it: hang up, find your actual IT team's number yourself, call back. Legitimate help desks don't cold-call employees and demand remote access without a prior support ticket.
MFA (multi-factor authentication, where logging in requires a second proof of identity such as a code sent to your phone) wouldn't have stopped this. The criminals weren't stealing passwords; they were convincing real, already-authenticated employees to hand over control. That's the part worth sitting with: the weakest point here isn't a protocol or a patch, it's the moment a person decides to trust a voice.
