Fake IT Calls on Microsoft Teams Lead to GoGRPC Backdoor Infections

Zscaler ThreatLabz reports an active vishing campaign (via Microsoft Teams Quick Assist) that tricks employees into approving remote sessions, allowing attackers to deploy a GoGRPC backdoor and supporting tools to run commands, create proxies, and exfiltrate files (via S3Siphon); researchers assess the operator likely acts as an initial-access broker supplying access for ransomware actors.