Hackers Pose as IT Helpdesk on Microsoft Teams to Deploy Chaos Ransomware

Gbhackers •Mayura Kathir • July 30, 2026

Hackers are abusing Microsoft Teams voice calls and fake IT helpdesk personas to gain remote access to corporate endpoints, drop a custom post‑exploitation toolchain, and, in multiple cases rapidly pivot to Chaos ransomware deployment across North American organizations. Nearly 95% of observed intrusions hit North American targets, with services, manufacturing, energy, construction and IP‑focused legal […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Vishing Campaigns Target Organizations via Microsoft Teams and New Operator Console A vishing campaign, tracked as STAC4749, targeted North American organizations from February to June 2026, using Microsoft Teams to impersonate IT personnel and gain remote access. Attackers deployed a modular toolset, including a custom loader and backdoor, leading to subsequent ransomware deployment. Concurrently, Okta's Threat Intelligence revealed insights into Work Panel, a vishing operator console facilitating account takeovers through streamlined phishing operations. This multi-tenant platform allows rapid campaign launches and employs a structured workforce with distinct roles. The campaigns reflect a growing trend in vishing tactics, with significant impacts across various sectors, particularly in the U.S. and Canada. 6 sources 70

Extracted Entities

Hackers Pose as IT Helpdesk on Microsoft Teams to Deploy Chaos Ransomware

The full story

Extracted Entities

Attack Types (1)

Industries (5)

Ransomware Groups (1)

Tools (1)