Microsoft Teams vishing lures victims into Chaos ransomware deployments

Intelligence Summary

Threat actors impersonate IT support during Microsoft Teams calls to trick victims. The goal is to obtain remote access to corporate devices and persist in the environment. Once access is established, the attackers deploy the Chaos ransomware. The campaign targets organizations in North America. The risk is rapid compromise and data loss through ransomware execution, so users should treat unexpected Teams calls as suspicious and verify access requests through trusted channels.

Recommended Action

Prioritize immediate review, validate exposure, and patch or mitigate affected systems.

Topics