Microsoft Teams Vishing Attack Exploits Quick Assist for GoGRPC Backdoor

Key Takeaways

• A new vishing campaign leverages Microsoft Teams and Quick Assist to gain initial access to corporate networks.
• Attackers impersonate IT support, using social engineering to trick employees into granting remote access.
• The primary payload is GoGRPC, a Go-based backdoor capable of command execution, system reconnaissance, and persistent access.
• This threat actor may function as an initial access broker for ransomware groups, posing a significant risk to targeted organizations.
• The attacks exploit human trust rather than technical vulnerabilities, underscoring the importance of robust security awareness training.

A sophisticated vishing campaign targeting corporate systems has been identified, utilizing Microsoft Teams communications and Microsoft Quick Assist to establish remote access. This operation subsequently deploys GoGRPC, a potent backdoor written in Go, which allows attackers to execute commands, gather system intelligence, and maintain a foothold within compromised environments.

The threat actor behind this activity is believed to serve as an initial access broker, potentially facilitating subsequent ransomware deployments. Their methodology combines multiple social engineering tactics, including inbox flooding, impersonation of IT personnel via Microsoft Teams, and manipulation into initiating Quick Assist sessions. These techniques collectively aim to pressure employees into trusting fraudulent support requests and granting unauthorized access.

Security researchers at Zscaler said in a report that they have been monitoring this campaign between January and June 2026. Their analysis indicates a consistent expansion of the actor’s toolset and an increasing focus on targeting corporate entities. This campaign serves as a critical reminder that legitimate remote support tools can become significant entry points for adversaries when employees are successfully coerced into approving malicious access.

Past incidents involving similar Microsoft Teams support call attacks demonstrate how rapidly a convincing helpdesk impersonation can escalate into a broader network security incident. Organizations must remain vigilant against these evolving social engineering tactics.

Microsoft Teams Vishing Attack Details

The attack sequence typically initiates with a spam bombing technique, overwhelming a victim’s email inbox with a deluge of unwanted messages. While the employee is distracted by this influx, an attacker contacts them via Microsoft Teams, falsely claiming to be a member of the organization’s IT helpdesk. This coordinated approach aims to maximize the chances of successful social engineering by exploiting the victim’s immediate frustration and perceived need for assistance.

During the Microsoft Teams interaction, the imposter attempts to persuade the target to open a Quick Assist link and authorize a remote support session. Should the employee grant this access, the attacker gains direct control over the device, enabling them to execute PowerShell commands and download additional malicious payloads. This method exploits user trust rather than relying on software vulnerabilities, making it particularly dangerous. Employees experiencing unexpected technical issues, especially those seemingly related to their recent email problems, are more susceptible to these convincing but fraudulent requests, particularly when the attacker demonstrates knowledge of their name, workplace, or current issues.

GoGRPC and Expanding Toolset

Upon gaining remote access through Quick Assist, the attackers proceed to download and execute GoGRPC using PowerShell. This Go-based backdoor establishes persistence by creating a Windows Registry Run value, ensuring it automatically launches each time the user logs into the system. Researchers have identified four distinct variants of GoGRPC, designated as Lep, Giver, Pet, and Kind. While all variants share fundamental backdoor functionalities, they exhibit differences in their implementation of encryption, code obfuscation, victim fingerprinting capabilities, and command execution features.

GoGRPC communicates with its command-and-control (C2) infrastructure via gRPC over HTTP/2, commonly utilizing port 443. The more recent Pet and Kind variants incorporate Transport Layer Security (TLS) support, which can further obscure malicious traffic by blending it with legitimate encrypted web connections, making detection more challenging. The backdoor gathers crucial system information, including computer name, username, domain specifics, Windows version, and details about installed security software. This reconnaissance data allows attackers to evaluate the compromised environment’s value for deeper intrusion or subsequent attacks. The backdoor can then receive commands to perform further discovery tasks, tailoring the attack to the specific victim.

Beyond GoGRPC, the operation has also been observed employing other tools such as BlindDoor, RevSocket, PyGRPC, S3Siphon, and RSOX. This diverse toolset provides a range of capabilities, from remote command execution and network tunneling to data exfiltration, significantly increasing the risk that initial access could escalate into extortion or the deployment of ransomware.

What You Should Do

• Verify Unsolicited Requests: Employees must be trained to treat all unsolicited messages, calls, and Quick Assist requests, even those appearing to originate from internal IT, as highly suspicious. Always verify such requests through a known, established internal channel (e.g., a dedicated helpdesk number, not a number provided by the caller).
• Restrict External Communications: Organizations should implement policies and technical controls to restrict external communications via Microsoft Teams where appropriate. Limit Quick Assist usage to only approved IT staff and for legitimate, pre-scheduled support sessions.
• Monitor for Suspicious Activity: Security teams should actively monitor for unusual PowerShell activity, unauthorized modifications to Windows Registry Run entries, unexpected remote support sessions, and abnormal outbound gRPC or WebSocket connections. Implement monitoring practices similar to those used for PowerShell backdoor delivery tactics to detect similar staging behaviors.
• Prepare Incident Response: Develop and regularly test incident response procedures. An early warning and swift action can prevent the escalation of initial access into more severe incidents, such as the <a href="https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/e4c63a5e-04ad-4cda-8842-37832d486757/Microsoft-Teams-Vishing-Attack-Uses-Quick-Assist-to-Deploy-GoGRPC-Backdoor.pdf?AWSAccessKeyId=ASIA2F3EMEYE7R6VX3HY&Signature=dipYU%2BLKIgu4ruYACcJg6Bl2YoM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEJf%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCICFRbvISq3zkFlWje8G702cSJIK2TBJ0e5laQsZ6m0rlAiEAl1D9U2jNbvZ6YDIihb9cCtDpELCCl%2FF3lm5jGa8Z8fAq8wQIXxABGgw2OTk3NTMzMDk3MDUiDOCsz4zIlDfBXpesgirQBFEPwiJmuGvFFHTqTjakK0%2BdsA8%2BaFma%2FCnKCXjlkYzvgQiN4GQh4FBwDSfoKnQ1VIAVTv7

  Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.

  Tags:

  AttackExploitMalwareransomwareSecurityThreat