UNC6692 AutoHotKey Binary Execution via Teams Vishing Delivery Chain

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•1

Detects renamed AutoHotKey binaries launched from user-writable paths by a browser or Teams parent process, spawning cmd or powershell as children. This activity is associated with UNC6692 ("Snow Flurries") impersonating IT helpdesk over Teams, luring victims to a fake "Mailbox Repair Utility" page, and delivering a renamed AHK binary + same-named script from an attacker S3 bucket to install the SNOWBELT extension.