CuraSec

tag: Microsoft-Teams · 3 items

Act Spring Ring campaign uses Teams voice phishing to hit domain controllers
2026-08-31 · Unit 42 · source ↗ #vishing#microsoft-teams#malware
  • Engineer — Learn: No CVE or patch required; the attack path abuses Teams social engineering rather than a software flaw, so review Teams external-access settings and restrict who can initiate calls from outside the tenant.
  • SOC/IR — Act: Active enterprise campaign targeting domain controllers via Teams vishing — hunt for anomalous Teams call activity from external tenants followed by process execution or lateral movement, and review Unit 42’s published TTPs for detection rule development.
  • Leader — Plan: Campaign targets enterprise domain controllers through a trusted communication channel (Teams), raising both breach-risk and vendor-trust questions — brief IT leadership and consider tightening external Teams communication policies this quarter.
Plan Microsoft Teams adds admin control to block external bots in meetings
2026-08-25 · BleepingComputer · source ↗ #microsoft-teams#collaboration-security#admin-controls
  • Engineer — Plan: Enable the Teams meeting protection policy in your tenant admin settings to prevent uninvited external bots from joining meetings — worth configuring this quarter as part of M365 hardening.
  • SOC/IR — Skip
  • Leader — Skip
Plan SynkLoader malware spread via Microsoft Teams phishing for cred theft
2026-08-22 · BleepingComputer · source ↗ #microsoft-teams#phishing#credential-theft
  • Engineer — Learn: No exploitable software vulnerability here — the attack surface is social engineering over Teams external messages. Review whether your Teams tenant restricts external/guest messaging and confirm phishing-resistant MFA is enforced for all accounts.
  • SOC/IR — Plan: Active campaign using Teams external messages to deliver a fake lock screen overlay for credential harvesting; build or tune detections for Teams-sourced phishing followed by unusual lock screen events and credential access patterns in EDR telemetry.
  • Leader — Learn: Confirms Microsoft Teams is an active credential-phishing vector, useful context for awareness training priorities, but no corroborating signals or sector-specific targeting reported that would require immediate leadership action.