Ransomware Campaigns Use Email Bombing and Microsoft Teams Vishing for Initial Access
Sophos MDR reported two ransomware campaigns that combined email bombing with voice phishing over Microsoft Teams to gain initial access to targeted organizations. In the observed intrusions, attackers overwhelmed users with large volumes of emails and then contacted them through Teams while impersonating IT or help desk staff, using the confusion to persuade victims to grant remote access or follow attacker-directed steps. The activity highlights how adversaries are blending social engineering with trusted enterprise collaboration tools to bypass technical defenses.
The campaigns were tied to ransomware operations and show a repeatable intrusion pattern in which attackers exploit user fatigue, trust in internal support workflows, and the widespread use of Microsoft 365 services. The reported tradecraft underscores the need for organizations to harden Teams and remote-support processes, verify help desk interactions through separate channels, and train staff to treat unsolicited support calls during email floods as suspicious, especially when they involve requests for remote access, credential entry, or security tool changes.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
1 event from the most recent confirmed update back to the earliest known activity.
Sophos publishes research on two ransomware campaigns using Teams vishing
Sophos MDR reported tracking two ransomware campaigns that used email bombing and Microsoft Teams voice phishing as part of their intrusion methods. The reference indicates public disclosure of the campaigns through Sophos threat research.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft Teams Vishing Used to Gain Remote Access and Deploy Malware
Attackers used **Microsoft Teams** to impersonate IT or helpdesk staff and socially engineer employees into granting access or executing malicious actions, turning collaboration tooling and trusted support workflows into the initial access vector. One report describes a compromise at an Italy-based consumer services company where a Teams meeting invite and screen sharing session led the victim to run a staged **PowerShell** chain that deployed **PhantomBackdoor**, a multi-stage **WebSocket-based** backdoor associated with earlier spear-phishing activity. The observed sequence included post-call PowerShell execution, device reconnaissance, and establishment of WebSocket command-and-control. A second report describes a similar **vishing** intrusion in which a threat actor posing as support staff called employees through Teams and, after multiple attempts, convinced one user to grant remote access through **Quick Assist**. The attacker then directed the victim to a spoofed credential-harvesting site, used a malicious **MSI** and sideloaded **DLL** to launch follow-on payloads, and established outbound C2. While the malware families and exact post-compromise chains differ, both accounts document the same operational pattern: **Teams-based social engineering**, abuse of legitimate remote assistance or user-guided execution, credential theft or payload staging, and transition to hands-on intrusion activity inside a corporate environment.
Mar 21, 2026
Microsoft Teams Vishing Campaign Deploys Nimbus RAT via Quick Assist and Cloud Services
Attackers used **email bombing** and fake IT support messages over **Microsoft Teams** to trick employees into launching **Windows Quick Assist**, giving remote access that led to the deployment of **Nimbus RAT**. eSentire said the campaign targeted corporate organizations globally, with notable impact on the legal sector, and observed a full compromise path from Teams contact to RAT execution in under 20 minutes. In one documented intrusion, the victim received more than 280 legitimate subscription emails before being contacted by an actor-controlled Teams account, then was directed to download malware from a compromised **Microsoft 365** tenant hosted on **SharePoint**. Nimbus RAT is a Java-based backdoor bundled with **OpenJDK** to run on Windows systems and uses **Google Drive** and **Google Sheets** for command-and-control, helping malicious traffic blend into normal SaaS activity. Researchers said the malware supports command execution, file and registry manipulation, screenshot capture, in-memory payload execution, and credential theft, while a secondary tool, **InboxSetupPro**, uses **OneDrive** for exfiltration and steals communications data including **Signal** attachments and large offline email archives. eSentire reported **1,540** similar Teams-related events across **172** customer environments, with activity rising sharply from December 2025 through March 2026, prompting recommendations to restrict external Teams communications, disable Quick Assist where possible, monitor transfers to public cloud storage, and train users to spot email-flooding and fake helpdesk tactics.
Jun 4, 2026
Microsoft Teams Phishing Campaigns Drive MFA Theft and RMM-Based Intrusions
Threat actors are increasingly abusing workplace collaboration platforms, especially **Microsoft Teams**, to impersonate IT staff, vendors, and support personnel in social-engineering attacks that bypass user trust controls. Palo Alto Networks Unit 42 reported that collaboration-tool phishing accounted for **42%** of all phishing alerts seen in Cortex during the first four months of 2026, up from **30%** in the prior four-month period, showing a broader shift away from traditional email lures. The attacks commonly pressure users to approve multifactor authentication prompts or otherwise grant access, and researchers said both criminal and nation-state actors are using the technique. Cyfirma separately identified an active Teams-themed campaign that uses fake meeting transcript and recording notifications to lure victims to counterfeit landing pages hosted on compromised websites and attacker-controlled cloud infrastructure, including Cloudflare Workers and Pages. Victims are served a signed Windows installer that silently deploys a legitimate remote monitoring and management tool connected to attacker relay servers, then establishes persistence through a Windows service and registry changes, including mechanisms that survive Safe Mode with Networking. The intrusion chain also includes anti-analysis checks and credential theft via a credential provider DLL and an LSA authentication package, indicating the campaign is designed to convert a trusted collaboration message into durable unauthorized access.
Jun 24, 2026