Microsoft Teams Vishing Attack Uses Quick Assist to Deploy GoGRPC Backdoor

A new Microsoft Teams vishing campaign is using fake IT support calls to gain remote access to corporate systems.

The attackers then deploy GoGRPC, a Go-based backdoor that can run commands, collect system details, and maintain access to compromised devices.

The activity appears linked to a threat actor that may serve as an initial access broker for ransomware operations.

Its methods combine inbox flooding, Microsoft Teams impersonation, and Quick Assist sessions to pressure employees into trusting fraudulent support requests.

Analysts at Zscaler identified the campaign while tracking activity from January through June 2026.

Zscaler said in a report shared with Cyber Security News (CSN) that the group has steadily expanded its toolset and increasingly focused on corporate targets.

The campaign is a reminder that remote support tools can become a serious entry point when users are manipulated into approving access.

Similar Microsoft Teams support call attacks have shown how quickly a convincing helpdesk impersonation can turn into a wider network security incident.

Microsoft Teams Vishing Attack Deploy GoGRPC Backdoor

The attack often begins with spam bombing, where a victim’s inbox is flooded with unwanted messages. While the employee is distracted, an attacker contacts them through Microsoft Teams and claims to be from the organization’s IT helpdesk.

The caller attempts to persuade the target to open a Quick Assist link and approve a remote support session.

Once access is granted, the attacker can interact with the device and launch PowerShell commands to download additional payloads.

This approach abuses trust rather than relying on a software flaw. Employees facing unexpected technical problems may be more likely to accept help, especially when the attacker appears to know their name, workplace, or recent inbox issue.

Organizations should require employees to verify unexpected support requests through a known internal channel before starting a remote session.

Restricting external Teams communications and limiting Quick Assist use to approved IT staff can also reduce exposure to fake IT support calls.

GoGRPC and Expanding Toolset

After the Quick Assist session is established, the attackers use PowerShell to download and execute GoGRPC. The malware creates persistence through a Windows Registry Run value, allowing it to launch again when a user signs in.

Researchers identified four GoGRPC variants named Lep, Giver, Pet, and Kind. They share core backdoor functions but differ in their use of encryption, code obfuscation, victim fingerprinting, and command execution features.

GoGRPC communicates with its command-and-control infrastructure through gRPC over HTTP/2, usually on port 443. Later Pet and Kind variants added TLS support, which can make malicious traffic less obvious among normal encrypted web connections.

The backdoor gathers information such as computer name, username, domain details, Windows version, and security software data.

It can then receive commands to run discovery tasks, helping attackers assess whether the victim’s environment is valuable for further intrusion.

The operation has also used BlindDoor, RevSocket, PyGRPC, S3Siphon, and RSOX.

These tools provide capabilities ranging from remote command execution and network tunneling to data theft, increasing the risk that initial access could lead to extortion or ransomware deployment.

Security teams should watch for suspicious PowerShell activity, unauthorized Registry Run entries, unexpected remote support sessions, and unusual outbound gRPC or WebSocket connections.

Monitoring practices described in coverage of PowerShell backdoor delivery tactics can help investigators spot similar staging behavior.

Employees should treat unsolicited Teams messages, calls, and Quick Assist requests as suspicious, even when they appear to come from IT.

Organizations should also prepare incident-response procedures because an early warning may prevent the type of follow-on ransomware activity seen in recent ransomware access operations.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.