Hackers Pose as IT Support on Microsoft Teams to Target More Than 150 Employees

Cybersecurity researchers have uncovered a social-engineering operation named Spring Ring that used external Microsoft Teams accounts to impersonate IT help desk staff. Between January and April 2026, the campaign targeted more than 150 employees at least 10 organizations across multiple industries. The attackers did not exploit a flaw in Microsoft Teams . Instead, they abused the trust employees place in workplace communication tools. They created external Teams identities…

Diamond Model