Threat Gang 'Springs' Vishing Attacks on Microsoft Teams Users
Threat actor 'Spring Ring' targets Microsoft Teams users with vishing attacks.
A threat actor known as 'Spring Ring' is conducting a sophisticated operation targeting Microsoft Teams users. The campaign employs vishing (voice phishing) tactics to trick users into granting unauthorized access to their Teams sessions. The ultimate goals include spreading malware, gaining remote access, and potentially compromising entire infrastructures.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft Teams?
Get an email when a new story names Microsoft Teams, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe 'Spring Ring' threat actor is exploiting human psychology rather than technical vulnerabilities, using voice phishing (vishing) to manipulate Microsoft Teams users into voluntarily granting unauthorized access to their sessions. This attack succeeds because users are not trained to recognize social engineering delivered via voice calls, especially when the attacker impersonates trusted entities like IT support. Once access is granted, attackers can deploy malware and pivot laterally across entire organizational infrastructures. This campaign highlights that even robust technical controls can be bypassed when employees are not equipped to identify and respond to social engineering threats.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.