Researchers at ReliaQuest have observed a surge in voice phishing (vishing) and Microsoft Teams phishing over the past several months, particularly from extortion groups like ShinyHunters.
“Attackers overwhelmingly targeted users and their unmanaged devices to gain access to accounts,” the researchers write. “Vishing, device-code phishing, external Teams impersonation, stolen tokens, and attacker-controlled authentication methods let threat actors operate through identities and services organizations already trusted. Once inside, they used legitimate software and over-privileged accounts to collect data, move laterally, and prepare for extortion or encryption.”
Employees should be wary of unsolicited calls or messages from tech support, even if the calls appear to be coming from known coworkers.
“Organizations across multiple industries faced a sustained wave of help-desk impersonation that tricked users into allowing attackers into their networks,” ReliaQuest says. “Attackers commonly posed as internal IT support and contacted employees through external Microsoft Teams accounts or voice calls, including calls to personal phones. Because these interactions often occurred outside security monitoring, the first activity visible to defenders often resembled a legitimate sign-in, device registration, or MFA change.”
Social engineering will always be a favored initial access vector. Security awareness training can give your organization an essential layer of defense against these attacks.
“These attacks remained prevalent because they’re simple to execute and repeatedly work,” the researchers write. “Attackers need only to persuade a user to complete a familiar action, such as opening remote-support software, approving an authentication request, or entering a device code. They can then replay stolen tokens, manipulate MFA, or register their own devices and authentication methods, turning one successful interaction into access that remains active after the original password is reset or its sessions terminated.”
ReliaQuest has the story: https://reliaquest.com/blog/threat-spotlight-whats-trending-top-cyber-attacker-techniques-june-2026-august-2026/
