Vishing Campaigns Target Organizations via Microsoft Teams and New Operator Console

A vishing campaign, tracked as STAC4749, targeted North American organizations from February to June 2026, using Microsoft Teams to impersonate IT personnel and gain remote access. Attackers deployed a modular toolset, including a custom loader and backdoor, leading to subsequent ransomware deployment. Concurrently, Okta's Threat Intelligence revealed insights into Work Panel, a vishing operator console facilitating account takeovers through streamlined phishing operations. This multi-tenant platform allows rapid campaign launches and employs a structured workforce with distinct roles. The campaigns reflect a growing trend in vishing tactics, with significant impacts across various sectors, particularly in the U.S. and Canada.

Key Points: • STAC4749 vishing campaign targeted North American organizations using Microsoft Teams. • Work Panel enables rapid deployment of vishing operations with distinct roles for operators. • The campaigns have led to ransomware deployments and indicate a rise in vishing tactics.