Between January and April 2026, a threat group dubbed “Spring Ring” exploited Microsoft Teams help desk impersonation to infect endpoints and attempt broader enterprise compromises. Attackers posed as internal IT support—registering external.onmicrosoft.com accounts with names like “Help Desk,” “IT Support,” or even impersonating real staff—then initiated chats with employees at over ten organizations. Once contact was made, they pivoted to voice calls to pressure victims to install remote access tools or execute malware. The operation targeted more than 150 individuals in total.
How Spring Ring Carried Out the Attack
In their first mode of attack, Spring Ring operators kicked things off with a Teams chat from a fake external account. After establishing the chat, some moved directly to voice calls—leaving voicemails or contacting multiple targets—sometimes persisting after being ignored. These live conversations often stretched 10–15 minutes, providing just enough time to reduce suspicion and build trust.
Two main campaigns—Campaign A and Campaign B—were observed. In Campaign A, attackers successfully tricked employees into using utilities like Quick Assist or installing remote monitoring and management tools. Once remote access was established, PowerShell was used to drop an obfuscated remote-access trojan (RAT).
Campaign B upped the ante. In this variant, attackers delivered a cloud-hosted executable that included the target company and employee in its name. The malware then replicated itself into temporary directories, launched hidden components, and used sideloaded browser extensions. The adversaries used Python and SMB to map out internal systems, then triggered NTLM-based techniques—like the PetitPotam relay attack—to try to force domain controllers to authenticate to attack-controlled machines. Though the domain takeover was blocked in observed cases, the path to full enterprise control was clear.
Indicators and Defense Strategies
Security teams can use multiple indicators to detect these attacks. Defanged examples include recurring display names like “helpdesk@ithelpcenter365[.]onmicrosoft[.]com” and similarly generic help desk or support-style identities. Other red flags: authentication flow anomalies, launches of remote support tools, hidden exe components named “vhlp-*.exe” or “scnr-*.exe,” weird cloud downloads, unusual SMB traffic, and attempts at NTLM relay attacks.
To minimize risk, organizations should restrict external Teams chats to those with a defined business purpose. Staff should treat unexpected support requests—especially via calls—as suspicious, verifying via independent channels. Monitoring usage of remote-access tools, scrutinizing file downloads, and auditing domain controller authentication activity are all essential. Educating users about unsolicited calls and deploying behavioral detection focused on external collaboration abuse can also disrupt the attack chain before it escalates.
The Spring Ring campaign demonstrates how seemingly benign communication tools like Microsoft Teams are being hijacked as covert entry points. By abusing features designed for collaboration and leveraging trust in internal-sounding support voices, attackers can bypass email-centric defenses and breach deeper into networks.
This attack vector highlights the evolving nature of social engineering. As email phishing defenses improve, adversaries are shifting toward live interaction schemes and platform deception. Companies need to update training, enforce safeguards around third-party and external accounts, and extend architecture-level protections. Otherwise, today’s innocuous Teams prompt may become tomorrow’s network compromise.
