Blog
AI-Powered Spear-Vishing Meets a Microsoft Teams Zero-Day
The attack on the affected organization had two critical elements.
The first problem: AI-powered spear-vishing via Microsoft Teams
First, attackers launched an AI-powered spear-vishing attack via Microsoft Teams. Employees received Teams calls from an external account impersonating an internal developer they knew. The caller’s voice had been cloned using AI, making the interaction appear credible. The attacker then convinced employees to share their screens and grant remote control through Teams, effectively turning a trusted collaboration platform into an initial-access channel.
The second problem: A Microsoft Teams zero-day
The incident becomes even more concerning when combined with a reported Microsoft Teams zero-day affecting remote-control containment.
A zero-day generally refers to a previously unknown or unaddressed security vulnerability for which an effective fix or or established mitigation may not yet be available. In this case, the concern relates specifically to an already-established Teams remote-control session.
According to a security advisory published on GitHub in June 2026, testing showed that revoking the controlling account’s Microsoft Entra ID sessions forced the account to reauthenticate and prevented it from initiating new authenticated interactions. However, the existing remote control session reportedly remained active, allowing continued control of the remote computer.
This creates an important incident-response problem:
Revoking the attacker’s identity session does not not necessarily terminate the attacker’s existing Teams remote-control session.
Microsoft reviewed the reported behavior through the Microsoft Security Response Center (MSRC) but determined that it did not meet the criteria for a vulnerability requiring servicing. Therefore, this issue should not be presented as a Microsoft-confirmed zero-day or authentication bypass. From a defensive perspective, however, the reported behavior represents a significant potential containment gap that security teams need to consider.
Why the combination is so dangerous
The two issues reinforce each other:
AI voice impersonation → trusted Teams call → screen sharing → remote control → interactive access → Teams zero-day containment problem
The AI-powered spear-vishing attack gives the attacker access to the workstation, while the reported Microsoft Teams zero-day may complicate the SOC’s ability to terminate that access once it has been established.
That is what makes the combination particularly dangerous.
Organizations can no longer assume that a familiar name or even a familiar voice proves who is behind a Teams call. During incident response, disabling an account or revoking sessions should not automatically be taken as proof that an active remote control connection has been terminated.
Contact
Ready to strengthen your company’s security?
Talk to us.
You might also like this
- White papers
- Blog
