Cybersecurity researchers have uncovered a widespread cyber espionage and extortion campaign in which threat actors leverage Microsoft Teams voice phishing (vishing) calls to compromise corporate networks and deploy Chaos ransomware. Tracked by security firm Sophos as STAC4749, the financially motivated operation targeted dozens of organizations across North America between February and June 2026. By posing as internal IT support staff, the attackers systematically tricked targeted employees into granting remote desktop access, allowing the intrusion set to escalate privileges, exfiltrate sensitive enterprise data, and execute ransomware within hours.
Attack Methodology and Social Engineering Tactics
The campaign relies primarily on direct voice and chat interaction through Microsoft Teams to establish initial trust. Posing as legitimate corporate helpdesk personnel, the operators contact employees regarding fictitious technical issues or urgent security updates. To bypass initial skepticism, the threat actors register IT-themed domains under the .top top-level domain (TLD) and create convincing account personas utilizing plausible enterprise usernames. Scam calls observed by incident responders ranged from brief 90-second exchanges to extended sessions lasting over 20 minutes.
Once an employee is engaged, the callers guide the target into launching legitimate remote administration software. While early stages of the campaign favored built-in Windows applications like Microsoft Quick Assist, the group later transitioned to third-party utilities including RemSupp, AnyDesk, and DWAgent. By utilizing legitimate administrative tools rather than custom malware during initial contact, the attackers successfully bypass traditional security filters and endpoint protection mechanisms that monitor for unverified execution binaries.
Post-Exploitation Mechanics and Evasion Tactics
Upon securing interactive remote control over a victim’s workstation, STAC4749 operators execute administrative PowerShell commands to establish persistent access and inspect the host environment. The threat actors stage custom loaders and Python-based backdoors within hidden user directories, such as AppData\Roaming. To ensure continuous network access across system reboots, the malware writes registry Run keys and places Visual Basic scripts in the Windows Startup folder, frequently disguising these entries under legitimate service names like Realtek or WinAudio.
For command-and-control (C2) communication, the deployed implants utilize gRPC protocols to retrieve Golang-based payloads authenticated via unique token arguments. The group also incorporates hardcoded digital certificates to enforce certificate pinning, enabling malicious network traffic to blend seamlessly with routine encrypted corporate communications. Post-compromise discovery scripts gather essential host telemetry—including operating system build versions, machine GUIDs, local security software configurations, and domain user privileges—before attempting to enable Remote Desktop Protocol (RDP) to move laterally across adjacent network segments.
Rapid Deployment and High-Impact Targeting
The campaign demonstrated remarkable speed, with security analysts recording instances where Chaos ransomware was deployed across an enterprise network in less than 17 hours from initial phone contact. Prior to initiating full-disk encryption, the attackers frequently exfiltrate valuable corporate documents and proprietary data to cloud storage infrastructure to establish double-extortion leverage. Once network-wide control is achieved, the threat group executes the Chaos ransomware payload, encrypting files and dropping ransom notes titled readme.chaos.txt across affected directories.
Demographic analysis reveals that the STAC4749 campaign heavily focused on organizations located in Canada (50 percent) and the United States (44 percent). Affected sectors span professional services (20 percent), manufacturing (17 percent), energy (12 percent), and construction and engineering (12 percent). Notably, all targeted legal organizations specialized in intellectual property (IP) law or IP services, indicating deliberate selection aimed at acquiring highly confidential proprietary data.
Defense Strategies and Remediation Protocols
In light of the escalating abuse of collaboration platforms for voice phishing, security researchers recommend that enterprise administrators review default Microsoft 365 tenant configurations. Restricting external domain communications within Microsoft Teams prevents unknown external actors from initiating unsolicited calls or chat requests with internal staff. Organizations should also implement application control policies to block unauthorized remote support software, monitor endpoint PowerShell execution logs for anomalous script execution, and conduct periodic audits of startup registry keys to detect hidden persistence mechanisms.
