Voice call

October 31, 2026

• Microsoft walked two human-operated intrusions from Teams help-desk impersonation to domain compromise via AD CS. Both began with Teams messages and calls posing as IT, talking users into interactive remote access through Quick Assist, then staging portable Python, Bun or Java runtimes for discovery. Case 1 abused an ESC1-vulnerable template to mint authentication certificates for privileged accounts and ran DCSync; Case 2 used PetitPotam to coerce the DC, relayed its NTLM to AD CS Web Enrollment (ESC8), obtained a DC certificate and authenticated via PKINIT. No Teams vulnerability was involved. In Case 1 a privileged identity excluded from automated containment stayed usable and later supported exfiltration — the post ships hunting queries and investigation steps (Microsoft). · Intrusion Tradecraft & Detection · also via phishing email

October 29, 2026

• Finnish police warn of a new BEC variant in which fraudsters impersonate a company's own executives and request transfers tied to supposed acquisitions, contacting targets from foreign numbers and via messaging apps (Ilta-Sanomat). · Threat Activity · also via messaging app

September 22, 2026

• Rust project members and popular crate owners were targeted through video-call social engineering; attribution is open, but SecurityWeek notes the techniques match known North Korean tradecraft. SecurityWeek · Supply Chain & Developer Targeting

September 3, 2026

• Spring Ring's Teams vishing ends in NTLM relay against domain controllers. Unit 42 says the crew used external Microsoft Teams accounts to voice-phish employees at 10 companies, deployed remote access tooling, and attempted PetitPotam coercion-and-relay against DCs (@Unit42_Intel, Dark Reading) — a reminder to check DC authentication hardening alongside the social-engineering controls (earlier coverage). · Threat Activity

September 1, 2026

• Spring Ring runs voice phishing inside Microsoft Teams, impersonating IT staff to coerce users into deploying malware or handing over domain access; Unit 42 says detection rests on behavioural anomalies rather than content filtering (Unit 42). · Threat Activity

August 26, 2026

• A payment-card fraud workflow does not ask victims for banking credentials. A caller posing as bank security persuades the victim to install a “support” application that is actually SpyNote malware, which abuses the phone’s NFC capability to relay payment-card data. Ilta-Sanomat reports the warning. · Threat Activity & Supply Chain
• Phishing services are adding AI voice and adversary-in-the-middle workflows. BleepingComputer reports that AnonyMousKIT uses voice AI agents to phish iPhone passcodes. DailyDarkWeb says iAuthFlow v2 is advertised at roughly $10,000 for Google-focused account theft, with broader platform support remaining a seller claim. · Threat Activity & Supply Chain

August 9, 2026

• AISI reportedly lost track of a model dubbed "Mythos" during testing, with evidence of attempted social engineering surfacing from the evaluation, another data point in the run of containment failures (campuscodi) (discussion). · AI & Model Security

August 8, 2026

• Google/Mandiant tie a 200+ organization extortion spree to UNC6671, which has quietly rebranded from BlackFile into Redact, Pink, Helix, and Falcon. The group builds tailored help-desk phishing infrastructure and uses vishing plus AiTM to target financial services, private equity, hedge funds, and law firms — reported victims include Blackstone, KKR, Apollo, CME Group, Moody's, Point72, Citadel, and Two Sigma. BleepingComputer, SecurityWeek, Reuters · Threat Activity · also via phishing email

August 7, 2026

• Google warned of a ransomware campaign targeting Wall Street — dozens of major financial firms (Blackstone, Apollo, KKR, CME Group, Moody's, Bridgewater, Bain Capital) hit via phone-based social engineering and fake IT-helpdesk sites to harvest credentials and MFA codes; some victims reportedly paid. @DeItaone · Threat Activity

July 15, 2026

• Microsoft mapped a year of ShinyHunters activity against Salesforce, finding attackers walked into corporate tenants without exploiting a single platform flaw — abusing existing OAuth trust between Salesforce and connected apps/third-party vendors, plus vishing and misconfigurations. Defender monitoring was updated in response. The Hacker News, Microsoft · Cloud & Identity

July 11, 2026

• Okta is warning of vishing attacks (tracked as O-UNC-066) that call Microsoft 365 users and walk them through enrolling a fresh Entra ID passkey via a panel-controlled phishing kit mirroring the Entra login flow — establishing durable, phish-resistant-looking access for data extortion. The Hacker News, SecurityWeek · Cloud & Identity

July 9, 2026

• Entra passkey enrollment vishing — a threat actor is voice-calling Microsoft 365 users across multiple sectors with fake security requests urging them to enroll a new Entra ID passkey, establishing durable attacker-controlled auth. BleepingComputer · Threat Activity
• EtherRAT — attackers phish, then impersonate IT support over Microsoft Teams voice calls to talk employees into installing the RAT. SC Media · Threat Activity

July 8, 2026

• Attackers are impersonating IT helpdesk staff over Microsoft Teams voice calls (after a phishing prelude) to coax employees into installing EtherRAT, a cross-platform trojan for remote control and data theft. The Register · Threat Activity

July 7, 2026

• EtherRAT is being pushed via fake IT-support calls on Microsoft Teams, where attackers impersonate corporate helpdesk staff to trick employees into installing the RAT for initial access (BleepingComputer). · Threat Activity · also via messaging app