A Two

Cybersecuritynews •Tushar Subhra Dutta • July 30, 2026

A short Microsoft Teams call can now become the first step in a ransomware attack. Attackers posing as IT support staff are persuading employees to grant remote access, then using that foothold to spread through networks and deploy Chaos ransomware. The campaign, tracked as STAC4749, targeted dozens of North American organizations between February and June […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Vishing Campaigns Target Organizations via Microsoft Teams and New Operator Console A vishing campaign, tracked as STAC4749, targeted North American organizations from February to June 2026, using Microsoft Teams to impersonate IT personnel and gain remote access. Attackers deployed a modular toolset, including a custom loader and backdoor, leading to subsequent ransomware deployment. Concurrently, Okta's Threat Intelligence revealed insights into Work Panel, a vishing operator console facilitating account takeovers through streamlined phishing operations. This multi-tenant platform allows rapid campaign launches and employs a structured workforce with distinct roles. The campaigns reflect a growing trend in vishing tactics, with significant impacts across various sectors, particularly in the U.S. and Canada. 9 sources 70

Extracted Entities

A Two

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

MITRE ATT&CK (1)

Ransomware Groups (1)

Tools (1)