#microsoft-teams
5 articles
Financial services and technology organizations across North America and Europe bore the brunt of attacks tied to the Microsoft Teams tag between April and August 2026. Five articles documented four high-severity incidents and one critical event. Threat actors APT29, KongTuke, and Spring Ring were observed in these campaigns. The critical vulnerability CVE-2023-36036 featured prominently in the reporting. Enterprise and government sectors were also affected. The coverage spans a four-month period, with the most recent article published on August 31.
HIGHSpring Ring Vishing Campaign Targets Microsoft Teams Users
Spring Ring vishing hit 150+ employees across 10 firms via Microsoft Teams, pushing RMM tools and NTLM relay attacks against domain controllers.
HIGHIdentity Abuse via Trusted Chat Channels Quadruples, Unit 42 Warns
Unit 42 reports collaboration-tool identity attacks quadrupled in 12 months, with 99% of alerts tied to chat phishing. APT29 abused Microsoft Teams federation for credential theft.
CRITICALModeloRAT Campaign Abuses Microsoft Teams for Enterprise Intrusion
Rapid7 dissects an April 2026 intrusion where a fake IT Support Teams message delivered ModeloRAT via Dropbox, leading to privilege escalation, credential theft, and lateral...
HIGHMandiant: Fake Teams Help Desk Deploys Info-Stealing Malware
Mandiant details a social engineering campaign where attackers pose as Microsoft Teams help desk staff to trick victims into installing malware that steals credentials and session…
HIGHUNC6692 Hijacks Microsoft Teams to Deploy SNOW Malware Suite
UNC6692 impersonates IT helpdesk staff via Microsoft Teams chats to trick victims into installing SNOW malware — a custom backdoor with credential theft and lateral movement…
Stay Updated
Get the latest cybersecurity news delivered to your inbox.