Increase in Impersonation Vishing Attacks Leading to Data Extortion

The Threat

eSentire's Threat Response Unit (TRU) has identified an increase in vishing attacks leading to data extortion against organizations in the legal, healthcare, and financial service industries. Identified attack patterns match external observations and line up with Google Threat Intelligence Group's (GTIG) reporting on UNC6671. These attacks involve threat actors using impersonation techniques, contacting users over Microsoft Teams or by phone while posing as IT Support or named colleagues. The objective of these attacks is to trick users into entering credentials on Adversary-in-the-Middle (AiTM) phishing pages to gain unauthorized access to accounts, register new devices or Multi-Factor Authentication (MFA) methods for persistent access, and exfiltrate data.

Along with this, eSentire continues to see sustained high-volumes of attacks leveraging Microsoft Teams-based vishing against a wide range of industries, including manufacturing, legal services, business services, retail, and finance sectors. To protect against these attacks, organizations must implement identity controls to reduce the impact of compromised credentials.

What we're doing about it

• eSentire MDR for Log has detections in place to identify Microsoft Teams messages originating from external accounts from high-risk sources, suspicious Microsoft 365 sign in activity, and MFA changes made by users at risk
• IP addresses associated with real-world attacks are blocked via the eSentire Global Block List available to eSentire MDR for Network customers
• Indicators of Compromise (IoCs) have been added to the Threat Intelligence Feed and are available for Threat Feed subscribers
• eSentire's Threat Response Unit (TRU) will discuss this topic further in the November 2026 TRU Intelligence Briefing

What you should do about it

• Restrict external access within Microsoft Teams
  • Disable communication with unmanaged Teams accounts and only allow external Teams messages and calls with named partner domains, if required
• Control the usage of remote-assistance tools through the standardization of one approved tool
  • Additional Remote Monitoring and Management (RMM) and file transfer tools, such as Quick Assist, AnyDesk, Atera, ScreenConnect, WinSCP, and Rclone, should be blocked
  • Remote Access in video conferencing platforms should also be restricted
• Configure Conditional Access policies to restrict logins and access to sensitive applications to trusted and compliant devices only
  • Use these policies to limit which users can join devices to Microsoft Entra ID and restrict security information registration
  • Block device code flow policies to reduce exposure to device code phishing
• Implement risk-based access policies to identify and restrict potentially compromised identities
• Review session lifetime and sign-in frequencies to limit how long a session can persist before reauthentication is required
• Enable Continuous Access Evaluation (CAE) to allow supported services to act on critical events, such as account disablement or a password reset
• Implement Software-as-a-Service (SaaS) data protection and governance
  • Apply least-privilege Role-Based Access Control (RBAC) within SharePoint and OneDrive to limit the impact of a compromised account
  • Configure Microsoft Purview Data Loss Prevention (DLP) to identify, monitor, and protect data stored in SharePoint

Additional information

eSentire has observed an increase in Microsoft Teams-based phishing attacks throughout 2026, which has been highlighted in a recent advisory. In specific cases that have been linked to UNC6671, threat actors have been identified contacting users via Microsoft Teams or by phone, tricking them into navigating to organization-themed Adversary-in-the-Middle (AiTM) phishing domains. Threat actors use stolen credentials and sessions to register MFA tokens and devices for persistence and perform data exfiltration to conduct extortion.

Researchers at Okta identified cases in which threat actors linked to UNC6671 leveraged Work Panel, a full web application operator console used to run vishing campaigns. Work Panel leverages RocketReach, a commercial Business-to-Business (B2B) contact data service that allows threat actors to search for employee names, phone numbers, job titles, and social media profiles. The platform allows the attack chain to be mostly automated, enabling the attackers to find targets and conduct social engineering attacks quickly.

In one case observed by eSentire, 127 members of a customer's organization were contacted within a one-hour timespan, all by the same phone number. One user who answered the call was directed to an AiTM webpage tailored to the specific organization. Once the users' credentials and session were captured, the attacker relayed the session and used it to exfiltrate data from OneDrive within less than 10 minutes.

In another case, threat actors tricked a user into approving a new Authenticator App, using this to gain access to a Citrix Workspace and exfiltrate data via Google Drive. The threat actors conducted extortion using the stolen data, threatening to publicly release it if demands were not met. A second case, involving Google Drive for data exfiltration, was also identified, where a threat actor tricked a user via a Microsoft Teams call to grant remote control via Zoom, allowing data to be copied to a Google Drive.

Each of the above cases highlights a sustained targeting against organizations in the Law Firms and Legal Services, healthcare, and financial industries, where similar tradecraft has been identified. Users were initially contacted by attackers via vishing over Microsoft Teams or by phone, directed to themed AiTM phishing pages or registered new devices, and led to identity compromise and data theft. In the highlighted examples, and other cases, eSentire observed lure pages named after target organization ([firm].<lure-root>.com). eSentire also observed networks previously identified by GTIG, particularly AS51852 Private Layer INC (Switzerland) and AS11878 Tzulo, Inc. (United States), during the data exfiltration phase.

While these specific attacks have been seen against specific sectors, eSentire has continued to observe threat actors conducting vishing attacks via Microsoft Teams in order to deploy malware across numerous industries, indicating that this is not an isolated threat. Organizations should restrict external messages and calls from external sources, unless necessary; in these cases, restrictions should be placed to allow messages and calls only from legitimate business partners. Organizations should also implement identity controls, including Conditional Access policies, requiring a trusted and compliant device, restricting device and security info registration, and implementing risk-based access policies.

Indicators of Compromise (IOCs)

References

[1] https://www.cyber.gc.ca/en/alerts-advisories/al26-028-ongoing-help-desk-voice-phishing-campaign-targeting-canadian-organizations
[2] https://cloud.google.com/blog/topics/threat-intelligence/unc6671-targets-financial-services-and-enterprise-cloud-environments
[3] https://learn.microsoft.com/en-us/microsoftteams/trusted-organizations-external-meetings-chat?tabs=organization-settings
[4] https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/appcontrol-and-applocker-overview
[5] https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-device-compliance
[6] https://learn.microsoft.com/en-us/entra/identity/devices/manage-device-identities#configure-device-settings
[7] https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-security-info-registration
[8] https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-authentication-flows
[9] https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-policies
[10] https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-session-lifetime
[11] https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-continuous-access-evaluation
[12] https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models
[13] https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp
[14] https://www.esentire.com/security-advisories/surge-in-microsoft-teams-based-phishing-and-it-support-impersonation
[15] https://www.okta.com/blog/threat-intelligence/behind-the-scenes-of-a-vishing-operation/