Unit 42: Spring Ring vishing campaign turns Teams calls into RAT and NTLM relay attacks

Unit 42, the threat intelligence team at Palo Alto Networks, has detailed a voice phishing operation it calls Spring Ring, in which attackers posing as corporate IT staff contact employees through Microsoft Teams and persuade them to launch remote support tools or malicious files. According to figures cited in a dev.to summary of the report, the campaign reached more than 150 people at over 10 organizations between January and April 2026, and researchers linked the activity to 26 attacker accounts.

From Teams chat to phone call

The operators registered external Microsoft 365 tenants on the onmicrosoft.com domain and gave their accounts display names that looked like internal help desk or IT support personnel. Each target first received a one-on-one Teams chat, followed almost immediately by a voice call, a sequencing Unit 42 describes as a way to create urgency and make the impersonation convincing. Victims were then steered toward either installing a remote monitoring and management (RMM) tool or running an executable file.

Campaign A: RMM and a PowerShell RAT

In the first attack pattern, attackers talked victims through launching legitimate remote support software such as Microsoft Quick Assist, then used that foothold to enumerate devices and the wider domain. The operators next retrieved an obfuscated PowerShell remote access trojan from infrastructure Unit 42 associates with the domain san-sid.com, attempted to bypass AMSI, the Windows antimalware interface, and tried to connect the implant to command-and-control servers. In the incidents Unit 42 observed, RAT execution was blocked.

Campaign B: tailored payloads and NTLM relay

The second pattern delivered an executable through an S3 URL customized with the target's name. Once launched, it set up persistence, started a hidden Microsoft Edge process and installed browser extensions. Attackers then used Python to scan internal networks for SMB services on TCP port 445, forced authentication toward domain controllers with the PetitPotam technique, and attempted to relay NTLM authentication to gain domain privileges. Those relay attempts were also blocked in the observed cases, and Unit 42 has not confirmed a successful domain takeover.

What the campaign looks like in logs

Because the initial contact happens in Teams rather than email, mailbox logs alone cannot reconstruct the intrusion. Unit 42 highlights a cluster of signals across telemetry sources: Teams chats and immediate calls originating from external tenants, the same external ID approaching several users in quick succession, Quick Assist or unauthorized RMM sessions started by users who rarely use such tools, obfuscated PowerShell and AMSI bypasses, executables dropped in Temp directories, hidden Edge instances with sideloaded extensions, S3 URLs containing target names, and SMB or EFSRPC traffic including TCP/445 scans from unusual processes such as Python. The report recommends correlating chat, call, RMM, download and network events within a window of roughly 30 minutes, and treating an external Teams ID with an IT-style display name that calls right after first contact as a single high-value detection trigger.

Recommended defenses

Unit 42's priority mitigations are to restrict Teams communication with external tenants to genuine business needs, verify unexpected callers claiming to be IT through a separate channel, and require approval for Quick Assist and third-party RMM tools so standard users cannot authorize remote sessions. On the endpoint side, it advises PowerShell controls, AMSI enforcement, application control and EDR coverage. Against the later stages of the chain, it points to SMB signing, NTLM restrictions and Extended Protection for Authentication, which blunt relay attacks regardless of whether the social engineering succeeds.

Why it matters

Spring Ring shows social engineering shifting decisively from email to real-time voice on a collaboration platform most enterprises already trust and leave open by default. Every subsequent stage depends on a person answering a call and following instructions, which makes verification procedures and RMM governance as important as any detection tool. The campaign also leans on legitimate software, Teams, Quick Assist, Edge and Python, so it produces little conventional malware telemetry, and the gap between a nuisance call and domain compromise can come down to NTLM relay preconditions that administrators are able to close in advance.