As cited
Copy frozen at (site build).
threat intel
Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor
Since January 2026, Zscaler ThreatLabz tracked an initial access broker conducting targeted vishing attacks via Microsoft Teams and Quick Assist remote support sessions to compromise organizations. The threat actor deploys a Go-based backdoor named GoGRPC (four variants: Lep, Giver, Pet, Kind) alongside additional tools including reverse SOCKS proxies, data exfiltration utilities, and backdoors that perform reconnaissance and lateral movement discovery. The tooling has grown more sophisticated over six months, with recent campaigns targeting corporate environments selectively and increasingly using credential-based authentication, obfuscation, and encrypted communications.
Why it matters: Organizations are exposed to initial access by social engineering with Microsoft Teams impersonation; security teams must educate users on helpdesk vishing and implement controls to restrict Quick Assist execution in high-value environments.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor
Since January 2026, Zscaler ThreatLabz tracked an initial access broker conducting targeted vishing attacks via Microsoft Teams and Quick Assist remote support sessions to compromise organizations. The threat actor deploys a Go-based backdoor named GoGRPC (four variants: Lep, Giver, Pet, Kind) alongside additional tools including reverse SOCKS proxies, data exfiltration utilities, and backdoors that perform reconnaissance and lateral movement discovery. The tooling has grown more sophisticated over six months, with recent campaigns targeting corporate environments selectively and increasingly using credential-based authentication, obfuscation, and encrypted communications.
Why it matters: Organizations are exposed to initial access by social engineering with Microsoft Teams impersonation; security teams must educate users on helpdesk vishing and implement controls to restrict Quick Assist execution in high-value environments.
- Source published
- First seen by Cybersecurity Tracker