Researchers observed a coordinated social-engineering operation (“Spring Ring”) where attackers used external Microsoft Teams accounts to pose as internal IT help desk staff and start voice calls. Victims were pressured to install remote-control tools (like Quick Assist or other RMM software) or run malware, including downloads from attacker-controlled domains and tailored cloud links that looked company-specific.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get a Teams ping: “Hi, this is IT Help Desk, we need a quick call about a required update.” Looks normal, right? Between January and April 2026, more than 150 employees got this: chat turns into a voice call, and the ‘tech’ walks them through opening Quick Assist or installing a remote tool so they can “fix” an urgent issue. In some calls, they send a cloud link like company-org-filters-update-yourname.exe on an S3 URL you’ve never seen. It has your company and your name in it on purpose, just to make you click and run their malware. If an unexpected Teams “help desk” call asks for remote control or to run an installer, hang up and contact IT using your normal help desk channel, don’t do anything from that call.
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
This news roundup describes real social-engineering operations where attackers impersonate trusted support teams to trick people into giving up secrets. One campaign uses email/SMS/WhatsApp plus AI voice calls pretending to be Apple Support to steal iPhone passcodes, while another uses phishing…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
Google tracked three suspected Russia-linked groups running targeted phishing that abuses real login and authentication features (app passwords, OAuth, and device codes) to get into accounts. The lures often look like legitimate conference or diplomatic invitations, and some campaigns spoof…
North Korea-linked BlueNoroff is using fake Zoom and Microsoft Teams meeting pages shared from hijacked trusted contacts (often via Telegram) to trick victims into “updating” Zoom/Teams and running malicious commands. The phishing kit also fingerprints the victim’s browser to identify installed…
The roundup describes multiple real-world attacks where criminals manipulate people, not just systems, such as fake bank support calls that trick victims into installing phone malware, and “ClickFix” lures that convince Mac users to run malicious commands. It also highlights an AI-assisted…
