Microsoft-Teams on CuraSec

Spring Ring campaign uses Teams voice phishing to hit domain controllers

Mon, 31 Aug 2026 18:00:29 +0000

Engineer — Learn: No CVE or patch required; the attack path abuses Teams social engineering rather than a software flaw, so review Teams external-access settings and restrict who can initiate calls from outside the tenant.
SOC/IR — Act: Active enterprise campaign targeting domain controllers via Teams vishing — hunt for anomalous Teams call activity from external tenants followed by process execution or lateral movement, and review Unit 42’s published TTPs for detection rule development.
Leader — Plan: Campaign targets enterprise domain controllers through a trusted communication channel (Teams), raising both breach-risk and vendor-trust questions — brief IT leadership and consider tightening external Teams communication policies this quarter.

Tue, 25 Aug 2026 11:39:54 +0000

Engineer — Plan: Enable the Teams meeting protection policy in your tenant admin settings to prevent uninvited external bots from joining meetings — worth configuring this quarter as part of M365 hardening.
SOC/IR — Skip
Leader — Skip

Sat, 22 Aug 2026 11:32:44 +0000

Engineer — Learn: No exploitable software vulnerability here — the attack surface is social engineering over Teams external messages. Review whether your Teams tenant restricts external/guest messaging and confirm phishing-resistant MFA is enforced for all accounts.
SOC/IR — Plan: Active campaign using Teams external messages to deliver a fake lock screen overlay for credential harvesting; build or tune detections for Teams-sourced phishing followed by unusual lock screen events and credential access patterns in EDR telemetry.
Leader — Learn: Confirms Microsoft Teams is an active credential-phishing vector, useful context for awareness training priorities, but no corroborating signals or sector-specific targeting reported that would require immediate leadership action.