Spring Ring: Coordinated Vishing Campaign Exploits Microsoft Teams

• •Spring Ring targeted over 150 employees across 10+ companies using Microsoft Teams.
• •Attackers impersonated IT support to install malware via social engineering tactics.
• •Phishing alerts from collaboration platforms rose to 42% of all alerts in early 2026.

Between January and April 2026, a coordinated voice phishing campaign named Spring Ring targeted over 150 employees across more than 10 companies using fake IT support accounts on Microsoft Teams. Attackers registered external Teams tenants with names resembling internal IT departments to gain trust. The campaign involved two distinct attack vectors: one directed victims to launch remote support software, while the other sent malicious links disguised as legitimate files. Both methods aimed to install malware or gain remote access to victims' systems. Unit 42 of Palo Alto Networks documented the attacks and reported that phishing alerts from collaboration platforms surged to 42% of all alerts in early 2026. The campaign was characterized by its use of social engineering tactics, exploiting the trust users place in collaboration tools. The attacks were blocked before achieving their objectives, highlighting the need for enhanced security awareness training.