Spring Ring impersonated the help desk over external Teams accounts to relay NTLM at domain controllers
Unit 42 says the crew reached more than 150 employees at ten or more companies without a single software exploit, which puts Teams federation policy and NTLM relay hardening in scope and leaves the endpoint downstream.
The Watch · Security desk
What happened
- Unit 42 says a coordinated operation it calls Spring Ring used external Microsoft Teams accounts to pose as IT help desk personnel between January and April 2026.
- Its telemetry puts the reach at more than 150 employees across at least 10 companies in various industries.
- The chat sets up a voice call on which the operators try to coerce the employee into running remote monitoring and management tools or custom malware.
- In the more advanced variant, the attackers moved from the vishing call to a full NTLM relay attack aimed at the organization's domain controller.
- KnowBe4's Phishing Threat Trends Report counts a 41 percent rise in Teams-based attacks from October 2025 to March 2026, crediting the platform's default Chat with Anyone setting.
Why it matters
- What it limits constraint No CVE sits anywhere in this chain, so patch cadence and endpoint detection maturity do not shorten the exposure; the levers are tenant federation policy at the front and relay hardening at the domain controller.
- Who has to decide decision Every Microsoft 365 tenant now faces a live decision on inbound external chat. Keep the default open for partner convenience, or close it and force help desk contact into a channel employees can verify.
- Who's exposed exposure The persuasion happens on audio that most organizations neither record nor retain, so responders reconstruct the intrusion backwards from the payload and never recover the recruitment step.
- What it sets up precedent A crew that can hold a real-time call inside a trusted channel and then reach for public coercion tooling hands imitators a route built on live voice and off-the-shelf tools, sidestepping malware development and exploit purchase entirely.
Next story · Security · Oct 8
Teams meetings will take deepfake signals from certified outside detectors in NovemberConfirmed2 publishers
Teams already labels the stranger. Unit 42's own figure shows the warning Microsoft raises when an external identity opens a chat with a user [15]. Chats still landed in front of more than 150 employees at 10 or more organizations, an average of at least 15 targets per company [13], which reads as spraying inside each tenant rather than selecting individuals.
The second variant is the part that moves the control surface. Unit 42 says no software exploit is involved: the operators rely on live voice and on the trust employees place in SaaS collaboration platforms [9]. It also says that once the trust gap is crossed, the walk to domain-level privileges using open-source tools such as PetitPotam is short [6]. Put those together and the chain runs on configuration at both ends, namely who may open a chat into the tenant, and whether authentication relayed at a domain controller is accepted. Neither question resolves on the endpoint.
The trend figures deserve a closer read than the percentages suggest. Collaboration-tool phishing went from 30 percent to 42 percent of phishing alerts in Cortex across consecutive four-month periods [8], which is 12 points absolute and a 40 percent relative rise [17]. That is Palo Alto's own telemetry from its own install base, published in a post that also lists Cortex and Idira products as the mitigation [16]. KnowBe4's 41 percent covers October 2025 to March 2026, overlapping Unit 42's January to April window by three months [18], so the two numbers are one directional reading of a shared quarter rather than independent corroboration.
The outcome itself goes unreported. Unit 42 describes attempted payload delivery across two campaigns using two distinct vectors [5], gives no count of employees who executed anything, and names no threat group behind Spring Ring [7]. APT29, cited as prior art, ran Teams abuse the older way, with malicious links and fake Entra ID tenants aimed at harvesting credentials [14]. The delta is real-time audio, which lets the operator pivot on a hesitant victim, and which leaves thinner records than the file operations and mailboxes responders normally review [10]. Unit 42's framing is that identity has become the primary attack vector here [11]; the operational version of that is that the intrusion has a tenant and a federation setting behind it before it has a process tree.
What to watch
- Whether Microsoft changes the default on external chat initiation, or leaves each tenant to close it.
- Whether Unit 42's full write-up names the relayed protocol and the target service on the domain controller, which decides whether relay hardening blocks the advanced variant.
- Whether any targeted organization confirms domain compromise rather than attempted payload delivery.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+20
- Incentives70
- Confidence60
Perspective Coverage
3 publishers- Builder
- Builder 28%
- Operator
- Operator 65%
- Investor
- Investor 7%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Unit 42 uncovered a coordinated social engineering operation between January and April 2026 that leveraged external Microsoft Teams accounts to masquerade as IT help desk personnel; it names the activity Spring Ring.
- [2]
Unit 42 telemetry shows the operation targeted more than 150 employees across at least 10 companies in various industries.
- [3]
The Teams chat is a setup for a voice phishing call during which adversaries try to coerce victims into executing remote monitoring and management (RMM) tools or custom malware.
- [4]
In a more advanced variant, attackers transitioned from the vishing call to a full NTLM relay attack aimed at the organization's domain controller.
- [5]
Unit 42 breaks down two observed campaigns, both involving vishing manipulation that resulted in attempted payload delivery via two distinct attack vectors.
- [6]
Unit 42 states that once the trust gap is crossed, the path to domain-level privileges via open-source tools like PetitPotam is short.
- [7]
The Unit 42 overview describes outcomes only as attempted payload delivery, gives no count of targeted employees who executed a payload, and names no threat group as the operator of Spring Ring.
- [8]
In the first four months of 2026, phishing alerts from collaboration tools represented 42% of all phishing alerts in Cortex, up from 30% in the preceding four months.
- [9]
Spring Ring relies on active human voice interaction, allowing attackers to evade detection without a software exploit by exploiting the trust employees place in SaaS collaboration platforms.
- [10]
Unit 42 notes voice calls are often less monitored, recorded or documented than employees' digital file operations or email histories, giving attackers a secluded environment for lures.
- [11]
Unit 42 says the two campaigns demonstrate the weaponization of communication platforms as identity becomes a primary attack vector, and that Spring Ring moves attacks from a passive click-and-harvest model to real-time engagement in which attackers pivot on the victim's responses.
- [12]
KnowBe4's Phishing Threat Trends Report reports Teams-based attacks rose by 41% between October 2025 and March 2026, a surge KnowBe4 attributes to attackers exploiting the platform's default Chat with Anyone feature to start direct chats with users outside their organization.
- [13]
More than 150 targeted employees spread across at least 10 companies works out to an average of at least 15 targeted employees per company.
- [14]
Previous Teams-based attacks, such as those by Cloaked Ursa (aka APT29), focused on credential harvesting and group chat-based social engineering, often relying on malicious links or fake Entra ID tenants to appear legitimate.
- [15]
Unit 42's Figure 1 shows the warning Teams users receive when an external identity creates a chat with them.
- [16]
The Unit 42 post lists Palo Alto Networks products as protections against the described threats, including Advanced URL Filtering, Cortex XDR and XSIAM, Cortex Advanced Email Security, Cortex Cloud Identity Threat Detection, and Idira ITDR, EPM, PAM and SIA, and directs readers to the Unit 42 incident response team.
- [17]
The collaboration-tool share of Cortex phishing alerts rose 12 percentage points between the two four-month periods, a 40 percent relative increase.
- [18]
KnowBe4's October 2025 to March 2026 measurement window overlaps Unit 42's January to April 2026 observation window by three months (January, February and March 2026), so the two figures partly describe the same period.
Sources
3 independent publishers whose own reporting we read for this story.
- helpnetsecurity.comVishing campaign abuses Microsoft Teams to give attackers a foothold in company networks
1 article · September 1, 2026
- scworld.comNew 'Spring Ring' operation uses vishing via Microsoft Teams
1 article · September 3, 2026
- unit42.paloaltonetworks.comSpring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams
1 article · August 31, 2026
Topics and entities
Topics
- Help desk impersonation
- NTLM relay attacks
- Voice Phishing and Help-Desk Impersonation
- Collaboration platform security