ghost calls

The tag 'ghost calls' on WindowsForum.com covers a post-exploitation technique that abuses TURN infrastructure in Microsoft Teams and Zoom to tunnel command-and-control traffic. Attackers hijack temporary TURN credentials issued during meeting joins, routing malicious traffic through the platforms' media relays and trusted IP ranges. This traffic mimics normal WebRTC flows, allowing it to bypass firewalls, proxies, and TLS inspection without exploiting any patchable bug. The technique highlights a novel attack vector for enterprise collaboration tools, emphasizing the need for monitoring unusual TURN usage patterns and credential reuse. Discussions focus on detection challenges and defensive strategies for IT and security teams.