Microsoft Teams vishing attacks lead to Chaos ransomware attacks
Microsoft Teams vishing campaign STAC4749 deploys Chaos ransomware against North American organizations.
Threat actors impersonating IT support staff via Microsoft Teams calls are social engineering employees into granting remote access via Microsoft Quick Assist or RemSupp tools, leading to backdoor installation and Chaos ransomware deployment. The campaign, tracked as STAC4749 by Sophos, targeted dozens of organizations across Canada and the US between February and June 2026, with at least three incidents resulting in ransomware deployment in under 17 hours. Attackers used fake IT-themed domains under .top TLDs and disguised persistence mechanisms as legitimate Realtek and Windows audio components.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft Teams?
Get an email when a new story names Microsoft Teams, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers exploited employee trust in internal IT support by impersonating helpdesk staff over Microsoft Teams, convincing victims to hand over remote access via legitimate tools like Quick Assist. Once inside, they deployed backdoors disguised as trusted audio drivers before launching Chaos ransomware — all within 17 hours of initial contact. This attack succeeds not because of a software vulnerability, but because employees lacked the awareness and verification processes to distinguish real IT staff from impostors. The speed of compromise underscores how social engineering can bypass technical controls entirely, making human-layer defenses critical.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — sequrityupdate.top
- domain — scan-security.top
- domain — system-connect.top
- domain — corp-connect.top
- domain — supportsoft.top
- malware — Chaos ransomware