Since early 2026, attackers have been targeting Windows users with a cunning social-engineering scheme: they call employees over Microsoft Teams, impersonate IT help-desk staff, and convince them to open a Quick Assist remote-control session. Once connected, the attackers deploy a sophisticated Go-based backdoor called GoGRPC, giving them a persistent foothold for data exfiltration and, ultimately, ransomware. Zscaler ThreatLabz, which uncovered the campaign, warns it is becoming more selective and harder to detect.
A Team Call Turns into a Remote Heist
The attack begins with an unsolicited Microsoft Teams call, often from an account spoofing an organization’s help desk or a trusted name. The caller claims there’s an urgent security issue—something about a suspicious login or a needed update—and directs the employee to open Quick Assist, a legitimate Windows remote-help tool. Quick Assist generates a six-digit code; the victim reads it aloud, and the attacker connects.
At that moment, the screen-sharing prompt appears, but once granted, the attacker gains full remote control. From there, the intruder launches a PowerShell script that profiles the system: checking antivirus software, domain membership, user privileges, and installed applications. According to Zscaler’s analysis, the newer scripts are more discerning—they only proceed if the machine meets certain criteria, indicating a corporate target worth exploiting.
The main payload is GoGRPC, a backdoor written in Go that uses gRPC over HTTP/2 for command-and-control (C2) communication. ThreatLabz identified four variants, each with distinct traits:
| Variant | Encryption | Key Characteristics |
|---|---|---|
| Lep | None (plaintext gRPC) | Early version, straightforward C2 |
| Giver | None (plaintext gRPC) | Modified persistence mechanisms |
| Pet | TLS | Encrypted gRPC, harder to detect |
| Kind | TLS | Added anti-analysis features |
The Pet and Kind variants, in particular, wrap C2 traffic in TLS, making it indistinguishable from normal HTTPS to many network sensors. This evolution shows the attackers are actively refining their tools to evade detection.
Once the backdoor is in place, the attackers deploy auxiliary tools to maintain access and steal data. RevSocket, PyGRPC, and RSOX are SOCKS proxy tools that create network tunnels, allowing lateral movement to other systems. S3Siphon is a data harvester that scours common user folders—Desktop, Documents, Downloads, Pictures, Videos, and OneDrive—and uploads selected files to an Amazon S3 bucket over HTTPS. The exfiltration is selective, focusing on files that could be used for extortion or further compromise.
Who’s at Risk and What’s at Stake
This campaign isn’t a spray-and-pray phishing attack. Zscaler assesses the actor is likely an initial-access broker (IAB) working for ransomware affiliates. That means every compromised workstation is a potential entry point into a corporate network, where the ultimate goal is to steal data and deploy encryption malware.
For the average home user, the risk is lower unless they are connected to a business network. However, freelancers, contractors, or anyone with access to corporate resources via a personal device could be the weak link. The attackers are opportunistic and will use any foothold.
For enterprise IT teams, the threat is severe. The use of Microsoft Teams—a trusted platform—and Quick Assist—a built-in, signed Microsoft tool—makes it exceptionally hard for traditional antivirus or endpoint detection to flag the activity as malicious. The attacker doesn’t need to trick code execution; the user literally invites them in. The subsequent PowerShell commands and Go payload may go unnoticed without specialized monitoring.
The GoGRPC backdoor itself is stealthy. gRPC is a high-performance RPC framework that uses multipart frames, often slipping past URL-based filters. And because it runs over HTTP/2, it blends into the sea of modern web traffic. The encrypted variants, Pet and Kind, further conceal the C2 data, making deep packet inspection ineffective unless the organization decrypts and inspects all traffic (a capability many lack).
The Evolution of a Persistent Threat
Remote-support scams are decades old, but this campaign represents an alarming convergence: social engineering over enterprise collaboration tools, abuse of an integrated Microsoft remote-access feature, and a custom backdoor built on a modern communication protocol.
Quick Assist was introduced in Windows 10 and became more prominent in Windows 11 as a “quick and easy” way for friends, family, or help desks to provide support. Its simplicity is its vulnerability: the six-digit code is all that’s needed for a connection, and Microsoft designed it to work without complex authentication. The attacker doesn’t need to phish a password or push malware; they just need to talk someone through the process.
Zscaler’s research shows the campaign has been active since January 2026, with at least four distinct GoGRPC iterations. The progression from unencrypted to TLS-encrypted C2 suggests the actor actively responds to detection efforts. Similarly, the shift from broad targeting to selective profiling indicates they’ve learned to avoid low-value victims and focus on enterprises with ripe data.
The use of Go is noteworthy. Go binaries are standalone and cross-platform, making them easy to compile and hard to analyze. gRPC, originally created by Google, is efficient and widely used in legitimate cloud services, so its presence isn’t inherently suspicious. By leveraging these technologies, the attacker blends in.
The likely IAB connection is critical: initial-access brokers don’t typically carry out the final ransomware deployment themselves. They sell access to other criminal groups. This means that once a network is compromised, multiple threat actors might pivot through it, using various post-exploitation tools.
How to Protect Your Windows Systems
The most direct defense is to remove Quick Assist if your organization doesn’t actively use it. Microsoft itself recommends this in its documentation. On Windows 11 24H2 with Enterprise or Education licensing, you can use a policy to remove the inbox app and block reinstallation. For other editions, you can uninstall it via Settings > Apps or with a PowerShell command:
Get-AppxPackage -allusers *QuickAssist* | Remove-AppxPackage
Microsoft also notes that blocking the Quick Assist service endpoint (remoteassistance.support.services.microsoft.com) via firewall or proxy will disable the tool, but be aware this also breaks Remote Help, which shares the same endpoint.
If Quick Assist is essential for your support workflows, enforce strict protocols. Never allow a support session that started with an unsolicited call or message. Instead, users should initiate a ticket, and IT should provide a unique session code through a known channel. Verify any caller by contacting the help desk using a published number—not one given by the caller.
User training should now include the specific scenario: “If someone calls you on Teams and asks for remote access, hang up and report it.” Many users don’t realize that Teams external calls can be spoofed or that Quick Assist can hand over full control.
On the technical side, security teams should harden endpoints against this attack chain:
- Monitor PowerShell execution, especially commands that download files (e.g.,
Invoke-WebRequest,New-Object Net.WebClient) or modify Run registry keys (HKLM\Software\Microsoft\Windows\CurrentVersion\Run). - Look for new executable files written to unusual locations, particularly Go or Python binaries that aren’t part of known software.
- Implement application allowlisting to block untrusted executables. Since Go backdoors often drop files in
%TEMP%or users’ AppData folders, restricting execution from these paths can help. - Network defenses should inspect HTTP/2 traffic, if possible, and block outbound connections to unknown gRPC destinations. If using a cloud proxy, enable TLS decryption for suspicious categories. While not perfect, it raises the attacker’s cost.
- Enable Windows Defender Attack Surface Reduction rules, specifically “Block executable files from running unless they meet a prevalence, age, or trusted list criterion” and “Block process creations originating from PSExec and WMI commands,” which can thwart lateral movement.
- For larger environments, deploy Sysmon with a well-tuned configuration to log process creation, network connections, and registry changes. Centralize logs in a SIEM and create alerts for the techniques described in Zscaler’s report.
- Zscaler provides detailed IOCs (indicators of compromise), including IP addresses and domains, which defenders can block proactively.
What to Watch Next
This campaign is unlikely to be the last to exploit Microsoft Teams and Quick Assist. As more organizations migrate to cloud collaboration tools, attackers will follow, refining their social-engineering hooks and technical implants. We expect to see similar attacks leveraging other remote support platforms like TeamViewer, AnyDesk, and even Zoom’s remote control feature.
The shift toward encrypted C2 within standard web protocols will continue, making network-based detection increasingly reliant on behavioral analytics and anomaly detection rather than signature matching. Organizations that invest in zero-trust architectures—where no device or user is trusted by default, even when inside the network—will be better insulated against these intrusions.
Microsoft may also evolve Quick Assist to include more robust authentication, but until then, the responsibility falls on users and administrators to treat every unsolicited remote access request as a potential attack.