[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAfv3DF-x9I_sPRjGOJ-F8xZ3qaGXW2PyYGUdMEVkNK0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":25,"status":26,"created_at":27,"published_at":28,"article":29,"tags":33,"podcasts":52,"controls":53},"f5d6b4d7-0b02-4c87-87ed-43b5feae1e10","it-impersonation-via-microsoft-teams-fuels-vishing-ransomware-and-oauth-attacks","4bc1ddb2-1b69-4a55-b79e-85f10fc491f9","IT Impersonation via Microsoft Teams Fuels Vishing, Ransomware, and OAuth Attacks","Threat actors are exploiting trusted collaboration platforms like Microsoft Teams to impersonate IT support staff, trick employees into granting remote access, and deploy malware — a tactic central to the Spring Ring vishing campaign. By abusing legitimate tools, attackers bypass traditional email-based phishing defenses and exploit user trust in internal-seeming communications. The escalation to NTLM relay attacks demonstrates how initial social engineering can rapidly pivot to credential theft and lateral movement. Meanwhile, PhaaS platforms like Outsider show that even law enforcement pressure cannot quickly dismantle industrialized phishing infrastructure, raising the stakes for organizations to harden defenses proactively.","**Immediate actions:**\n- Train all employees to verify IT support requests through a secondary, out-of-band channel before granting any remote access.\n- Restrict Microsoft Teams external communications so only approved external domains can initiate chats or calls with internal users.\n- Enforce phishing-resistant MFA (e.g., FIDO2 keys) across all accounts to reduce the impact of credential harvesting via OAuth or NTLM relay attacks.\n\n**Long-term improvements:**\n- Implement a Zero Trust access model requiring continuous verification before granting remote access to any system.\n- Audit and restrict OAuth application permissions regularly, removing any third-party app grants that are excessive or unrecognized.\n- Deploy endpoint detection and response (EDR) solutions configured to alert on remote access tool installations initiated from collaboration platforms.\n\n**Detection measures:**\n- Monitor for anomalous NTLM authentication attempts and relay activity across internal network segments using SIEM correlation rules.\n- Establish behavioral baselines for Teams usage and alert on unusual patterns such as external users requesting screen share or remote control.\n- Subscribe to threat intelligence feeds tracking PhaaS platforms and ransomware affiliate playbooks to update detection signatures proactively.",[12,13,14,15,16,17,18,19,20,21,22,23,24],"CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-17 – Remote Access","NIST SP 800-53 IA-5 – Authenticator Management","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST CSF DE.CM-1 – Network Monitoring","MITRE ATT&CK T1566.004 – Phishing via Service","MITRE ATT&CK T1557.001 – NTLM Relay","MITRE ATT&CK T1550.001 – Use Alternate Authentication Material: OAuth","GDPR Article 32 – Security of Processing",{},"published","2026-09-03T20:20:57.006024+00:00","2026-09-03T20:20:56.731+00:00",{"id":7,"url":30,"slug":31,"title":32},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fthreatsday-ceo-phishing-kits-5k-dropbox.html","threatsday-ceo-phishing-kits-5k-dropbox-account-hacks-oauth-traps-17-more-storie-eae086","ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories",[34,40,46],{"id":35,"name":36,"slug":37,"description":38,"color":39},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":41,"name":42,"slug":43,"description":44,"color":45},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":47,"name":48,"slug":49,"description":50,"color":51},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[54,58,62],{"slug":55,"name":56,"problem":57},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":59,"name":60,"problem":61},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":63,"name":64,"problem":65},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]