Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams
Palo Alto Networks, Monday, August 31st, 2026
Unit 42 analyzes the Spring Ring campaign, which abuses Microsoft Teams voice phishing to deploy malware and reach domain controllers.
Unit 42 documents Spring Ring, a campaign that uses voice phishing inside Microsoft Teams to gain a foothold in enterprise environments.
Attackers abuse Teams calling and chat to build trust with targets before persuading them to run malicious payloads. The research traces the post-compromise activity, which escalates toward enterprise domain controllers.
Palo Alto Networks details the tradecraft so defenders can detect the social engineering and the follow-on malware deployment.