Spring Ring: Voice Phishing via Microsoft Teams Targets Enterprises

Executive Summary

Between January and April 2026, Palo Alto Networks' Unit 42 identified a coordinated social engineering campaign named Spring Ring. The operation leverages external Microsoft Teams accounts to impersonate corporate IT help desk staff. Attackers initiate voice phishing (vishing) calls to coerce employees into executing malicious payloads, such as remote monitoring and management (RMM) tools or custom malware. In a more sophisticated attack chain, the threat actors escalate from a vishing call to a full NTLM relay attack targeting enterprise domain controllers. The campaign has impacted over 150 employees across at least 10 organizations, demonstrating a significant shift towards using trusted communication platforms as a primary vector for initial access and privilege escalation.

Threat Overview

The Spring Ring campaign represents a notable evolution in social engineering tactics, moving beyond traditional email-based phishing to the real-time, interactive environment of Microsoft Teams. Unlike previous Teams-based attacks from groups like Cloaked Ursa (APT29) that relied on malicious links or fake Entra ID tenants, Spring Ring's methodology is centered on live voice interaction. This allows attackers to dynamically adapt their approach based on the victim's responses, building trust and manipulating them into compromising their own systems.

The attackers operate from externally provisioned .onmicrosoft[.]com tenants, using professional-sounding display names like "help desk" or "IT assistance" to appear legitimate. Despite Microsoft Teams displaying a warning banner for communications from external accounts, the attackers successfully exploit the inherent trust employees place in the platform. Once a voice call is established, the attacker guides the target through steps to either install a payload or trigger a forced authentication sequence, paving the way for a domain-level compromise.

Technical Analysis

The Spring Ring attack lifecycle combines social engineering with technical exploitation in a multi-stage process.

1. Initial Access and Impersonation

The attack begins with the creation of external Microsoft Teams accounts within attacker-controlled Microsoft 365 tenants. These accounts are configured with display names designed to impersonate internal IT support. The attackers then initiate a direct chat with a targeted employee, which triggers a notification in the victim's Teams client.

2. Social Engineering via Vishing

Immediately after creating the chat, the attacker initiates a voice call. This is the core vishing element of the campaign. By engaging in a live conversation, the attacker builds a rapport of trust and authority. Telemetry shows these calls varied in duration from under a minute to over ten minutes, indicating persistent and adaptive social engineering efforts.

3. Payload Execution or Forced Authentication

Once trust is established, the campaign diverges into two primary attack vectors:

• Payload Delivery: The attacker coerces the victim into downloading and executing a malicious file, often a legitimate RMM tool or a custom PowerShell-based payload. This provides the attacker with remote access to the victim's machine.
• NTLM Relay Attack: In the more advanced variant, the attacker tricks the user into initiating an action that triggers a forced authentication event. The threat actors were observed preparing to leverage tools like PetitPotam, which coerces a machine to authenticate to an attacker-controlled listener. This allows the attacker to capture and relay the NTLM authentication hash to another service, such as Active Directory Certificate Services (AD CS) or a domain controller, to gain elevated privileges.

MITRE ATT&CK TTPs

The Spring Ring campaign utilizes the following MITRE ATT&CK techniques:

• T1585 - Establish Accounts: Attackers provision their own .onmicrosoft.com tenants to stage the attack.
• T1566.004 - Phishing: Spearphishing Voice: The core of the campaign relies on vishing calls via Microsoft Teams to manipulate victims.
• T1204.002 - User Execution: Malicious File: Attackers persuade users to run malicious software or RMM tools.
• T1187 - Forced Authentication: The advanced attack path involves coercing NTLM authentication from the victim's machine for relay attacks.
• T1059.001 - Command and Scripting Interpreter: PowerShell: Custom payloads observed in the campaign were delivered via PowerShell.

Impact Assessment

A successful Spring Ring attack poses a severe risk to an organization. Initial access via an RMM tool can lead to data theft, deployment of ransomware, or lateral movement across the network. The more advanced NTLM relay variant is significantly more dangerous, as it can lead to a full domain compromise. By targeting a domain controller, attackers can create privileged accounts, deploy group policies to distribute malware, and exfiltrate the entire Active Directory database. The targeting of over 150 employees indicates a scalable operation that can cause widespread disruption and significant data breaches if not detected and mitigated early.

IOCs — Directly from Articles

The following domains were used by attackers to provision malicious Microsoft 365 tenants for this campaign.

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns to detect activity related to the Spring Ring campaign:

Detection & Response

Defenders should focus on a combination of log analysis, endpoint monitoring, and network security to counter this threat.

1. Monitor Teams Activity: Regularly audit Microsoft Teams logs for suspicious external chat initiations. Create alerts for new conversations from external .onmicrosoft.com domains, especially those with generic IT support names. This can be achieved using D3FEND's User Behavior Analysis techniques.
2. Endpoint Detection (EDR): Deploy EDR solutions to monitor for the execution of unauthorized RMM software. Create detection rules for suspicious process chains, such as Microsoft Teams spawning PowerShell or other scripting engines. Utilize File Analysis (D3-FA) on any downloaded executables.
3. Network Traffic Analysis: Implement Network Traffic Analysis (D3-NTA) to detect anomalous NTLM authentication patterns. Monitor for and alert on authentication attempts against domain controllers originating from unexpected sources or involving user accounts that should not be performing such actions.
4. Incident Response Playbook: Develop a specific playbook for responding to Teams-based social engineering. This should include steps to immediately restrict the compromised user account, analyze Teams and endpoint logs, and scan the environment for signs of lateral movement or forced authentication activity.

Mitigation

Strategic and tactical mitigations can significantly reduce the risk of a successful Spring Ring attack.

1. User Training and Awareness: Conduct regular training focused on modern social engineering tactics, including vishing and platform-based impersonation. Teach users to be skeptical of unsolicited Teams messages from external accounts and to verify any requests to execute software or provide credentials through a separate, trusted communication channel.
2. Harden Microsoft Teams Configuration: If business needs permit, disable or restrict the ability for external users to initiate chats with internal employees. This can be configured in the Teams Admin Center. This falls under Application Configuration Hardening (D3-ACH).
3. Prevent NTLM Relay Attacks: Implement robust protections against NTLM relay. This includes enforcing SMB signing on all devices, enabling Extended Protection for Authentication (EPA) on servers (especially AD CS), and considering policies to disable NTLM where possible in favor of Kerberos. This aligns with Platform Hardening (D3-PH).
4. Application Control: Use application allowlisting technologies to prevent the execution of unauthorized RMM tools and other software. This is a core principle of Executable Allowlisting (D3-EAL) and is highly effective at stopping this attack chain.