The short answer
On 30 July 2026, Sophos disclosed a threat cluster it tracks as STAC4749: attackers who pose as internal IT support inside Microsoft Teams, talk employees into launching remote-access tools, and deploy Chaos ransomware in as little as 17 hours from first contact. Active between February and June 2026, the campaign targeted dozens of organisations, with about 95 percent in North America — roughly 50 percent in Canada and 45 percent in the United States — concentrated in services, manufacturing, energy, and construction and engineering.
The uncomfortable part is that nothing here is a software bug. The operators abuse a default Microsoft Teams setting that lets outside accounts message your staff, then exploit the instinct to trust "IT." Preventing it is an organisational and identity problem, which is exactly the surface a security testing and audit engagement is built to find before an attacker does.
What Sophos disclosed
In research published on 30 July 2026, Sophos described a financially motivated threat cluster it labels STAC4749 that ran from February through June 2026. Rather than phishing emails or exploiting an unpatched server, the operators went straight to employees through Microsoft Teams, using external accounts dressed up as internal or third-party IT support. The lure was mundane and effective: a "helpdesk" reaching out to fix a problem, delivered over the same tool people already use to talk to colleagues.
To make the accounts look plausible, the attackers registered IT-themed domains on the .top top-level domain — names in the mould of system-connect[.]top and supportsoft[.]top — and paired them with believable employee-style usernames. The calls were short: Sophos observed durations ranging from about 90 seconds to more than 20 minutes, but most lasting only two to two-and-a-half minutes. That is all the time it takes to walk a distracted employee through starting a remote session.
The geography is striking and should shape how US and EU leaders read this. Around 95 percent of the observed targets were in North America, split roughly 50 percent Canada and 45 percent United States, across services, manufacturing, energy, and construction and engineering. At least three of the intrusions ended with Chaos ransomware — a strain Sophos links to former members of the BlackSuit and Royal gangs, themselves Conti spin-offs — dropping a ransom note named readme.chaos.txt.
How the attack unfolds
The chain is worth understanding step by step, because each stage is a place you can break it. First, contact: an external Teams account messages or calls an employee, claiming to be IT and offering to resolve an urgent issue. Second, access: the "technician" persuades the target to start a remote-access tool — Sophos saw a strong preference for Microsoft Quick Assist, followed by a tool called RemSupp. Because these are legitimate utilities, no malware alarm fires at this point.
Third, persistence: once connected, the operators drop a PowerShell backdoor into the user's %AppData% folder and disguise the persistence mechanism behind registry entries masquerading as Realtek or Windows audio components — names an administrator glancing at a system is unlikely to question. Fourth, entrenchment: they layer on additional remote-control tools such as DWAgent or AnyDesk so that losing one channel does not lock them out. Only then, fifth, does the ransomware follow. In the fastest case, all of that fit inside 17 hours.
Read that sequence again and notice where the money moment is: the entire attack hinges on step two, the employee clicking to grant remote access. Everything after it is post-exploitation. That is good news for defenders, because it means the single most valuable control is not a better ransomware detector — it is making sure an outside "helpdesk" can never get an employee to that click in the first place.
Why this bypasses your defences
Many organisations have quietly left a door open without realising it. Microsoft Teams can, by default in some configurations, allow external accounts to chat with and call internal users; that convenience is precisely what STAC4749 turns into an initial-access channel. Email security stacks, meanwhile, are watching inboxes, not Teams calls, so a lure that arrives over collaboration software sails past the controls most companies have invested in most heavily.
The technique also sidesteps a lot of security spending because it uses trusted, signed software. Quick Assist ships with Windows; AnyDesk and DWAgent are commercial tools with legitimate uses. An endpoint agent that blocks known malware will happily watch a sanctioned remote-access utility start, because from the machine's perspective the user asked for it. The compromise is delivered through consent, not exploitation — which is why "keep everything patched" is necessary but nowhere near sufficient here.
There is a compliance dimension too. For teams pursuing SOC 2 or operating under GDPR and the EU's NIS2 regime, a social-engineering intrusion that leads to ransomware is exactly the kind of incident auditors and regulators expect you to have anticipated. Demonstrating security-awareness controls, hardened remote-access policies and a tested response plan is part of what SOC 2 readiness work is meant to prove — and vishing is now squarely in scope.
What it means for US & EU teams
For North American organisations especially, treat this as a live threat rather than a case study. The immediate move is configuration: review your Microsoft Teams external-access settings and default to blocking unknown outside accounts from messaging or calling staff, allowing only vetted partner domains. That one change removes the campaign's front door for most companies, and it costs nothing but a policy decision.
The second move is human and procedural. Employees need a clear, rehearsed rule: real IT will never cold-call or message out of the blue to push a remote-access tool, and any such request must be verified through an independent channel — a known internal number or ticketing portal, not a callback to whoever just called. Pair that with technical guardrails: restrict or monitor Quick Assist, alert on new installations of AnyDesk and DWAgent, and enforce least privilege so a single compromised laptop cannot pivot into the systems that matter.
For teams that build and operate software rather than just use it, the lesson is that your own delivery and support workflows are part of the attack surface. Contractors, nearshore engineers and helpdesk staff all interact over the same collaboration tools, and a rogue remote session on a developer's machine can reach source code, cloud credentials and CI/CD pipelines. Building identity verification, short-lived scoped access and audited remote support into how you work — and pressure-testing it — is the difference between a blocked call and a ransom note.
What to lock down this week
A short, practical sequence that turns the disclosure into action rather than anxiety:
- Close the Teams front door. Set external access to block unknown outside accounts from chatting or calling employees; allow only explicitly approved partner domains.
- Give staff a verification rule. Make it policy that IT never cold-contacts to request remote access, and give employees an independent way to confirm any helpdesk approach.
- Control remote-access tooling. Restrict or log Microsoft Quick Assist, and alert on the installation or execution of AnyDesk, DWAgent, RemSupp and similar utilities.
- Hunt for the persistence markers. Look for PowerShell payloads in
%AppData%and registry run-keys disguised as Realtek or Windows audio components, and for thereadme.chaos.txtnote. - Rehearse a sub-24-hour response. Assume an attacker can go from first contact to ransomware in under a day; test that your detection, isolation and escalation actually work at that speed.
STAC4749 is not exotic. It is a reminder that as defences around email and servers have hardened, attackers have simply walked over to the channel where trust is highest and scrutiny is lowest. Close that channel deliberately, and a campaign that ruined dozens of organisations' months becomes a two-minute call that goes nowhere.
Frequently asked questions
What is the STAC4749 Microsoft Teams vishing campaign?
STAC4749 is a threat cluster Sophos disclosed on 30 July 2026. From February to June 2026 the operators used external Microsoft Teams accounts to pose as IT support, calling and messaging employees at dozens of organisations. They talked targets into launching remote-access tools, deployed a PowerShell backdoor for persistence, and in at least three cases finished with Chaos ransomware. About 95 percent of the targets were in North America, split roughly evenly between Canada and the United States.
How does the Teams vishing attack actually work?
The attackers register IT-themed lookalike domains on the .top TLD and contact staff through Teams chat and short voice calls, usually two to three minutes long. Under the pretext of fixing an issue, they persuade the employee to start a remote-access tool such as Microsoft Quick Assist or RemSupp. They then drop a PowerShell backdoor into the %AppData% folder, hide persistence behind registry entries disguised as Realtek or Windows audio components, add tools like DWAgent or AnyDesk, and move toward ransomware.
How fast can this attack lead to ransomware?
Very fast. In the quickest case Sophos observed, less than 17 hours passed between the initial Microsoft Teams contact and the deployment of Chaos ransomware, which leaves a ransom note named readme.chaos.txt. That compressed timeline means preventing the initial remote-access foothold is far more reliable than trying to catch the ransomware at the end.
How do we defend against helpdesk-impersonation vishing on Teams?
Restrict Teams external access so unknown outside accounts cannot chat or call your staff by default. Give employees an out-of-band way to verify a helpdesk contact, and make clear that real IT never cold-calls to push a remote-access tool. Lock down or monitor Quick Assist and similar tools, enforce least privilege, keep endpoint detection tuned for backdoor persistence, and rehearse an incident-response plan that assumes an attacker can move in under a day.
Is this only a Microsoft problem?
No. The campaign abuses a default collaboration setting and human trust, not a vulnerability in Teams. The same playbook works over any channel that lets outsiders reach employees, and the remote-access tools involved are legitimate. The durable fix is organisational: tighten who can contact staff, harden identity and helpdesk verification, and control remote-access tooling and privilege, rather than waiting for a patch.
Sources
BleepingComputer — Microsoft Teams vishing attacks lead to Chaos ransomware attacks, 30 July 2026
IT Pro — A new vishing campaign is targeting Microsoft Teams: here's what users need to know, 29 July 2026
Sophos — Chaos in Teams vishing (STAC4749 research), July 2026