Vishing Campaigns Target Organizations via Microsoft Teams and New Operator Console

• •STAC4749 vishing campaign targeted North American organizations using Microsoft Teams.
• •Work Panel enables rapid deployment of vishing operations with distinct roles for operators.
• •The campaigns have led to ransomware deployments and indicate a rise in vishing tactics.

A vishing campaign, tracked as STAC4749, targeted North American organizations from February to June 2026, using Microsoft Teams to impersonate IT personnel and gain remote access. Attackers deployed a modular toolset, including a custom loader and backdoor, leading to subsequent ransomware deployment. Concurrently, Okta's Threat Intelligence revealed insights into Work Panel, a vishing operator console facilitating account takeovers through streamlined phishing operations. This multi-tenant platform allows rapid campaign launches and employs a structured workforce with distinct roles. The campaigns reflect a growing trend in vishing tactics, with significant impacts across various sectors, particularly in the U.S. and Canada.