Microsoft Teams Vishing Attack Uses Quick Assist to Deploy GoGRPC Backdoor

Cybersecuritynews •Tushar Subhra Dutta • July 28, 2026

A new Microsoft Teams vishing campaign is using fake IT support calls to gain remote access to corporate systems. The attackers then deploy GoGRPC, a Go-based backdoor that can run commands, collect system details, and maintain access to compromised devices. The activity appears linked to a threat actor that may serve as an initial access […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Teams Vishing Campaign Deploys GoGRPC Backdoor A vishing campaign utilizing Microsoft Teams has been identified, targeting organizations through fake IT support calls. Attackers persuade victims to open Quick Assist links, enabling remote access to systems. The primary tool deployed is GoGRPC, a Go-based backdoor capable of executing commands and collecting system information. This threat actor is suspected to be an initial access broker for ransomware operations, with campaigns tracked since January 2026. Multiple variants of GoGRPC have been identified, including Lep, Giver, Pet, and Kind. The campaign has been linked to spam bombing tactics to initiate the compromise. Additional malware tools such as BlindDoor and RevSocket have also been observed in these attacks. The ongoing threat poses significant risks to corporate security. 4 sources 70

Extracted Entities

Microsoft Teams Vishing Attack Uses Quick Assist to Deploy GoGRPC Backdoor

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (2)

Tools (1)