UNC6692 AutoHotKey Binary Execution via Teams Vishing Delivery Chain

Lacey Cochrane@NullVectorX

•updated Jul 6, 2026•15•0•24

Detects renamed AutoHotKey binaries launched from user-writable paths by a browser or Teams parent process, spawning cmd or powershell as children. UNC6692 ("Snow Flurries") impersonates IT helpdesk over Teams, lures victims to a fake "Mailbox Repair Utility" page, and delivers a renamed AHK binary + same-named script from an attacker S3 bucket to install the SNOWBELT extension.