Sophos has exposed a fast-moving Microsoft Teams voice-phishing campaign that dropped Chaos ransomware on at least three organizations, with one victim seeing encryption begin less than 17 hours after the first scam call. The threat group, tracked as STAC4749, targeted dozens of North American businesses between February and June 2026 by posing as IT support and convincing employees to grant remote control of their Windows PCs. Quick Assist—a legitimate support tool built into Windows—was the initial infection vector, demonstrating that social engineering, not a software flaw, is the campaign’s engine.

How the Attack Unfolded

The attackers initiated contact through Teams chats and calls, using a rotating cast of IT-themed .top domains and plausible names like Anthony Brooks or Ella Harper. Sophos observed calls lasting as little as 90 seconds, with most ranging between two and two-and-a-half minutes. The goal was to pressure the target into launching a remote-access session. Early operations relied on Microsoft Quick Assist; when that wasn’t available, the operators switched to RemSupp, a cloud-based remote monitoring tool. Starting in April, RemSupp became the preferred choice, likely because it’s less commonly blocked by application control policies.

Once remote control was granted, the attackers executed PowerShell commands to download and run a malware loader—first from attacker-controlled servers, later directly fetching a Pyinstaller-based backdoor. Filenames evolved over time, using prefixes like "sekv", "helper", and "74fs" followed by a random 10-digit number, later shifting to generic names like msupdate.exe. The payloads landed in user-writable directories such as %AppData%\Roaming to avoid requiring admin privileges.

Persistence was achieved through registry Run keys disguised as audio components (e.g., "Realtek HD Audio Universal Service", "WinAudio life2") and shortcut files in the Startup folder, sometimes hidden with file attributes. The backdoor then retrieved Golang implants that communicated with command-and-control servers using certificate pinning, making interception difficult. Certificate issuer names like loop-CA, connectify-CA, and james-bond-CA helped the threat actors segment their infrastructure by operation.

In several incidents, the attackers moved laterally by enabling RDP via msconfig and installing additional remote-access tools like AnyDesk or DWAgent. A custom reverse SOCKS proxy tool (sc5.exe) was also deployed to tunnel traffic out of the network. Then, often within hours, Chaos ransomware encrypted files across multiple endpoints simultaneously, dropping ransom notes named readme.chaos.txt.

Why Your Organization is at Risk

This campaign matters because it weaponizes tools your IT staff uses every day. Quick Assist is a standard Windows feature for remote help—it requires the recipient to enter a session code and approve screen sharing and control. A skilled vishing caller can walk an employee through these steps as if performing routine maintenance. Once granted, the attacker has the same access as a legitimate technician, with no exploit required.

The campaign’s speed is alarming. In one case, the entire intrusion—from the Teams call to ransomware execution—took under 17 hours. For many organizations, that’s shorter than the time it takes to notice the initial Teams contact, let alone investigate. If your security operations center treats a reported "IT support scam call" as low-priority, you could be dealing with encrypted servers by the next morning.

Organizations that use Teams federation are particularly exposed. By default, external users can send messages and make calls to your employees unless restricted. The STAC4749 operators exploited this by creating accounts on cheap .top domains, using names that mimicked helpdesk identities. Even if you think your spam filters are robust, they don’t block a real-time phone call from a stranger inside Teams.

How We Got Here: The Rise of Teams Vishing

Microsoft first flagged Teams vishing in mid-2024, when threat actors began impersonating IT support to push malware. Through 2025, ransomware groups like Black Basta (linked to GOLD REBELLION) and STAC5777/STAC5143 combined email bombing with Teams calls. Sophos’s own data shows a sharp increase in detected Teams vishing cases starting January 2026, with further spikes in March and May. While improved detection accounts for some of the rise, the trend is clear: attackers see collaboration platforms as a reliable avenue for initial access.

STAC4749 is notably more sophisticated than earlier teams-based attacks. The use of certificate-pinned C2, custom backdoors, and a modular toolkit suggests a group that values speed and operational security. The connection to Chaos ransomware—a relatively new RaaS operation that emerged in February 2025 from ex-BlackSuit members—and the possible Russian-language keyboard artifact hint at a professional, financially motivated team.

What to Do Now

You can’t patch social engineering. But you can make it much harder for an attacker to succeed. The most effective defense connects identity policies, endpoint visibility, and user training:

Tighten Teams Federation:
- Limit external access to only users who need it. Use domain allowlists if your business partners are stable.
- Block external users from initiating chats or calls with sensitive groups (finance, legal, execs, IT).
- Review Microsoft’s meeting policy to restrict joining externally hosted meetings while signed in.

Govern Remote Support Tools:
- If you don’t use Quick Assist, block or uninstall it via Microsoft’s guidance. Even if you do, restrict it to specific approved technicians.
- Maintain an approved list of remote-access tools (RMM, remote desktop) and deploy application control to block anything else.
- Alert on any remote-control launch that isn’t linked to a helpdesk ticket.

Establish a Clear Helpdesk Policy:
- Support never calls unsolicited. If someone claiming to be IT reaches out via Teams, employees should disconnect and call the official number.
- Technicians must provide a work-order number that the user can verify independently.
- Employees should be explicitly told they will not face repercussions for hanging up if something feels off.

Detect Suspicious Activity:
- Set up alerts for external Teams chats with newly registered support-themed domains.
- Monitor for PowerShell downloading executables to %AppData% or %Temp%.
- Scan for new Run keys in HKCU pointing to binaries in user-profile directories.
- Watch for VBS scripts creating shortcuts in Startup folders.
- Investigate any sudden RDP enablement or new installations of remote-control software.
- Correlate remote-assistance launches with the appearance of unknown outbound connections.

If a User Reports a Scam Call:
1. Immediately instruct the user to disconnect the remote session and unplug the network cable if feasible.
2. Isolate the machine: cut network access, start forensic collection.
3. Check for the presence of loader files, backdoors, Run keys, or ransomware notes.
4. Review the user’s sign-in logs and reset credentials if necessary.
5. Hunt across your environment for similar persistence mechanisms or c2 communication.
6. Assume lateral movement may be in progress—protect backups and critical servers.

Outlook

STAC4749 shows that vishing over Teams is not a passing fad. As long as external collaboration is enabled without tight controls, attackers will impersonate helpdesk staff. The technique’s effectiveness, combined with the low cost of registering deceptive domains, makes it attractive to both advanced and low-skill groups. Expect more campaigns to copy the playbook, possibly with new ransomware families or even AI-generated voice clones to enhance credibility.

For Windows admins, the lesson is plain: remote control should never be granted because a stranger calls and asks nicely. Hardening your helpdesk process, restricting external Teams access, and building detections that spot abuse of legitimate tools are the real patches—and they need to be deployed before the next call comes in.