---
title: "Coordinated Vishing Attacks Hit Microsoft Teams Users"
metaTitle: "Vishing Attacks Hit Microsoft Teams Users"
description: 'Palo Alto research reveals "Spring Ring" vishing campaign using fake Microsoft Teams accounts to social-engineer employees into granting remote access.'
slug: vishing-attacks-hit-microsoft-teams-users
date: "2026-09-10T12:00:00-05:00"
featured: true
image:
  src: "https://cdn.securelogix.dev/slx/images/spring-ring.webp"
  alt: "A hand holding a phone next to an open laptop as if both are required for the task depicted."
sourcePublisher:
  name: National Law Review
  url: "https://www.natlawreview.com/"
sourceArticle:
  url: "https://natlawreview.com/article/privacy-tip-507-coordinated-vishing-attacks-hit-microsoft-teams-users"
tags: [Vishing, Tech Support Scam, MFA]
status: published
---

A recent article released by the Palo Alto Threat Research Center found that, between January and April 2026, a coordinated effort by threat actors was successful in launching vishing attacks using Microsoft Teams accounts to compromise companies across multiple industries.

The threat actor uses an external Teams account and creates a chat "using identities designed to mirror legitimate internal support units." Usually these include names like help desk, IT support, or something else that makes the user believe the chat is coming from an internal IT support professional. The chat has a sense of urgency that something needs to be done on the user's computer. The threat actors then call the victim and, if the user picks up, the scam commences. The threat actor then guides the employee through steps to allow remote control or to download malicious malware...