Fake IT Calls on Microsoft Teams Lead to GoGRPC Backdoor Infections
Fake IT support calls on Microsoft Teams lead to GoGRPC backdoor infections.
Attackers are using vishing tactics on Microsoft Teams, posing as IT support to trick employees into granting remote access via Quick Assist. Once inside, they install the GoGRPC backdoor, written in Go, which allows command execution and network proxying. This campaign is suspected to be an initial access broker operation for ransomware attacks, with stolen data potentially used for extortion.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers are impersonating IT support staff on Microsoft Teams to socially engineer employees into granting remote access via Microsoft's own Quick Assist tool, a classic vishing (voice phishing) attack vector. Once access is granted, they deploy the GoGRPC backdoor, enabling persistent command execution and network proxying — likely as a precursor to ransomware deployment. This attack exploits employee trust in internal communication platforms and legitimate remote support tools, bypassing traditional perimeter defenses entirely. The human element remains one of the most exploited weaknesses in enterprise security, and the use of trusted, built-in tools makes detection significantly harder. Organizations that lack strict verification procedures for IT support requests are especially vulnerable to this type of initial access broker operation.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — GoGRPC
- malware — Lep
- malware — Giver
- malware — Pet
- malware — Kind
- malware — BlindDoor
- malware — RevSocket
- malware — PyGRPC
- malware — RSOX
- malware — S3Siphon