By therecord.media
Publication Date: 2026-04-27 13:33:00
Hackers are impersonating Microsoft Teams help desk workers to trick victims into installing data-stealing malware, according to a new report from Mandiant.
The campaign, attributed to a newly tracked threat cluster known as UNC6692, combines email flooding, phishing messages and malicious browser extensions to gain access to corporate systems, researchers at the Google-owned cybersecurity company said.
The operation begins with a large wave of emails designed to overwhelm a targeted inbox, after which the attacker reaches out via Microsoft Teams using an account outside the victim’s organization, posing as an IT support worker offering help with the email disruption.
During the conversation, the victim is instructed to install what appears to be a “patch” meant to stop the spam. Clicking the link opens a website masquerading as a “Mailbox Repair Utility,” prompting the user to download a script that ultimately installs a malicious browser extension called SnowBelt,…