# Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams

DevFeed: [Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](<https://devfeed.tech/articles/spring-ring-an-inside-look-at-voice-phishing-campaigns-in-microsoft-teams-7760.md>)

Original publisher: [Read original article](<https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/>)

Author: Noam Sala

Published: 2026-08-31T10:00:36Z

Content type: article

Language: en

Sources: [Unit 42](<https://devfeed.tech/sources/unit-42.md>)

Topics: [Social engineering](<https://devfeed.tech/topics/social-engineering.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [remote access software](<https://devfeed.tech/topics/remote-access-software.md>), [Microsoft](<https://devfeed.tech/topics/microsoft.md>), [Cloaked Ursa](<https://devfeed.tech/topics/cloaked-ursa.md>), [Entra ID](<https://devfeed.tech/topics/entra-id.md>), [Incident response](<https://devfeed.tech/topics/incident-response.md>)

Tags: [attacks](<https://devfeed.tech/tags/attacks.md>), [cloaked-ursa](<https://devfeed.tech/tags/cloaked-ursa.md>), [enterprise](<https://devfeed.tech/tags/enterprise.md>), [entra-id](<https://devfeed.tech/tags/entra-id.md>), [incident-response](<https://devfeed.tech/tags/incident-response.md>), [malware](<https://devfeed.tech/tags/malware.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>), [microsoft-teams](<https://devfeed.tech/tags/microsoft-teams.md>), [payload](<https://devfeed.tech/tags/payload.md>), [phishing](<https://devfeed.tech/tags/phishing.md>), [powershell](<https://devfeed.tech/tags/powershell.md>), [remote-access-trojan](<https://devfeed.tech/tags/remote-access-trojan.md>), [social-engineering](<https://devfeed.tech/tags/social-engineering.md>), [spoof](<https://devfeed.tech/tags/spoof.md>), [threat-research](<https://devfeed.tech/tags/threat-research.md>), [vishing](<https://devfeed.tech/tags/vishing.md>), [voice](<https://devfeed.tech/tags/voice.md>)

## AI overview

Spring Ring is a coordinated social engineering campaign that used external Microsoft Teams accounts and voice phishing to impersonate IT help desk staff. The operation targeted more than 150 employees across at least 10 companies and attempted to deliver remote monitoring and management tools or custom malware. A more advanced variant escalated to an NTLM relay attack against an organization's domain controller.

## Source excerpt

Learn how the Spring Ring campaign abuses Microsoft Teams and voice phishing to deploy malware and target enterprise domain controllers. The post Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams appeared first on Unit 42.