Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor

Reported 27 Jul 2026 by otx · Severity: medium

Since January 2026, a threat actor likely functioning as an initial access broker for ransomware operations has been targeting organizations through Microsoft Teams vishing attacks. Attackers impersonate IT helpdesk staff to convince victims to initiate Quick Assist remote sessio