Microsoft Teams Vishing Used to Gain Remote Access and Deploy Malware

Attackers used Microsoft Teams to impersonate IT or helpdesk staff and socially engineer employees into granting access or executing malicious actions, turning collaboration tooling and trusted support workflows into the initial access vector. One report describes a compromise at an Italy-based consumer services company where a Teams meeting invite and screen sharing session led the victim to run a staged PowerShell chain that deployed PhantomBackdoor, a multi-stage WebSocket-based backdoor associated with earlier spear-phishing activity. The observed sequence included post-call PowerShell execution, device reconnaissance, and establishment of WebSocket command-and-control.

A second report describes a similar vishing intrusion in which a threat actor posing as support staff called employees through Teams and, after multiple attempts, convinced one user to grant remote access through Quick Assist. The attacker then directed the victim to a spoofed credential-harvesting site, used a malicious MSI and sideloaded DLL to launch follow-on payloads, and established outbound C2. While the malware families and exact post-compromise chains differ, both accounts document the same operational pattern: Teams-based social engineering, abuse of legitimate remote assistance or user-guided execution, credential theft or payload staging, and transition to hands-on intrusion activity inside a corporate environment.