A chat request arrives in Microsoft Teams from an account called ithelpdesk. Seconds later it rings. On the other end is a calm voice that says it is from your IT department and needs you to run one small thing.
Between January and April 2026, Unit 42 counted 26 such identities working through more than 150 employees at more than 10 organizations. The researchers call it Spring Ring, and in one campaign it ended with an attempt to seize the victim's domain controller, the server holding the keys to every account in the company.
No software was exploited anywhere in the chain. The attackers used a legitimate product exactly as designed, and spent their effort on the person holding the phone. Unit 42 says plainly that it has no evidence of any compromise or vulnerability in Microsoft's product related to this campaign.
The tenant is real, the help desk is not
The accounts sit in external Microsoft 365 tenants the attackers provisioned themselves, on subdomains chosen to read like corporate infrastructure: ithelp@InternalSystemsDaily[.]onmicrosoft[.]com, HelpDesk@ITProtectionDepartment[.]onmicrosoft[.]com, itadmin@MandatoryNetworkMonitoring[.]onmicrosoft[.]com, ithelpdesk@CertifiedUpdateNetwork[.]onmicrosoft[.]com. In some approaches the operators dropped the generic role names and used the names of real people who work in the industry, which Unit 42 stresses does not mean those accounts were compromised.
Teams does warn a user when an external identity opens a chat, offering a Delete or Accept choice. It is a small speed bump in front of a voice that sounds like a colleague. Unit 42 reports that phishing alerts from collaboration tools represented 42% of all phishing alerts in Cortex during the first four months of 2026, up from 30% in the preceding four months.
Two campaigns that start the same and end differently
In the first, the caller walks the employee through starting Quick Assist or downloading third-party remote management software, then asks for remote control. Once on the machine the attacker ran whoami /groups and net group /dom to see whose account it had and what domain it sat in, then pulled an obfuscated PowerShell remote access Trojan from san-sid[.]com. Stripped of its anti-analysis padding, Unit 42 found a nine-line command and control stager that disables the Antimalware Scan Interface using the amsiInitFailed flag, runs a test scan to confirm the bypass worked, then beacons out for more payloads. Cortex XDR blocked it during execution.
The second campaign was tailored. The victim was sent to a cloud endpoint whose hostname and filename contained their own employer's name and their own name, in the shape company-org-filters-update-victim[.]exe. Running it copied the file into the Temp directory, spawned further copies as vhlp-*.exe and scnr-*.exe for persistence, and launched a hidden headless instance of Microsoft Edge with an attacker-written extension sideloaded into it. A bundled Python interpreter at C:\ProgramData\IntegrityData\python.exe then began scanning internal servers on port 445 and generating authentication traffic at the domain controller, finishing with a PetitPotam attempt: a trick that coerces the domain controller into authenticating to a machine the attacker controls, so the attacker can relay that authentication and inherit its privileges. Unit 42's managed detection team stopped it there.
The tell is the chat that becomes a call
The behavioural markers Unit 42 lists are cheap to hunt for. A one-to-one chat request from an external identity that turns into an unsolicited audio call within moments is the primary signal. One identity often approaches five or six people inside a few minutes, cycling fast, with calls ranging from 30-second misses to 15-minute sessions. The source addresses commonly come from commercial VPN services. On the endpoint, look for remote management tools launched by users who have never needed remote support.
Make first contact from outside your tenant loud
The cheapest control is to restrict who can start a chat with your staff from outside the organization, or at minimum to alert on the first message from any new external tenant. Pair that with an allowlist for remote management software and a help desk rule that never asks anyone to run a command during a call. IntelFusions has covered the same lure ending in ransomware earlier this summer.
Noam Sala published the full analysis for Unit 42, including the attack flow for both campaigns. The uncomfortable part is how little the attackers needed: a fresh tenant, a plausible display name and someone willing to pick up.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.