Watch out that Microsoft Teams chat might be hackers impersonating your IT support

Date:
Tue, 27 Oct 2026 23:05:00 +0000

Description:
Fake IT support pushes victims into granting hands-on access via remote management tools.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Attackers flood inboxes with spam, then impersonate IT support through Microsoft Teams messages and calls Victims are tricked into sharing remote access via Quick Assist, AnyDesk, or ScreenConnect Researchers observed 400+ incidents, warning default Teams federation settings enable the social-engineering campaign Cybersecurity researchers Arctic Wolf have warned of an ongoing, widespread hacking
campaign that includes an email inbox flooded with spam messages, a Teams account impersonating IT support, and the use of absolutely legitimate, everyday software.

The goal seems to be persistent access, possibly in preparation of a subsequent malware or ransomware infection. How the attack plays out In its report , Arctic Wolf said it observed the same pattern in more than 400
cases. It starts with the victim - an employee in the target company - receiving hundreds, possibly thousands of spam emails in a very short timeframe, so their inbox gets absolutely flooded with junk, burying any and all meaningful, valuable emails under a mountain of trash. Latest Videos From TechRadar Watch full video here:

A few moments later, that same person gets a Teams message from a user that, by all accounts, looks legitimate: their name clearly states IT Service Desk, and sometimes even has a first name next to it (something along the lines of Liam, Ethan, or Scott). They tell the victim theyve been made aware of the problems theyre having with their email (as the IT department should) and offer a solution.

To solve the problem, they need hands-on access to the victims keyboard, usually through a legitimate remote monitoring and management tool like AnyDesk or ScreenConnect. You may like IT helpdesk impersonation hits Microsoft Teams once again, with the hackers hiding their activity within legitimate tools Microsoft login pages are being abused as hackers try and lure in unlucky victims New malware targets Microsoft Teams users by posing
as your company's IT helpdesk

Obviously, this is all a ruse to get the victim to hand over access to their device. The same entity sent both the spam emails and the Teams messages. Sometimes, they even call the victim through Teams, rather than send a
message - to make the entire ordeal even more believable.

Arctic Wolf says the key enabler of the whole scheme is the fact that Microsoft Teams ships with external access (federation) turned on by default. That means that, unless the actual IT team changed the default settings in Teams, every employee can receive messages from anyone else with a Microsoft 365 account, even if they belong to an entirely different tenant (dedicated environment within Microsoft's cloud services). Unfortunately, this is not a bug, its an entirely legitimate feature that threat actors happily exploit: Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

This is the feature attackers most frequently abuse, Arctic Wolf says. This activity does not exploit any known Teams vulnerability; it abuses a legitimate, default-on collaboration capability. Lock down your Teams To make matters worse, when they ask for hands-on access, they dont ask the victim to install any special software. In most cases, they just ask them to bring up Quick Assist, a tool thats built directly into Windows, signed by Microsoft, and thus requires no installation. All victims need to do is send over a six-digit code and theyve handed over the keys to the kingdom.

What happens after that is anyones guess. The researchers saw the attackers then installing a commercial RMM tool such as AnyDesk or ScreenConnect to
gain a separate control channel, and make sure they retain access even if the Quick Assist one is revoked. They would then map out the target IT network
and do as much reconnaissance as possible, likely in preparation of a ransomware or malware attack.

Defending against these kinds of attacks starts with locking the proverbial doors on Teams. Most organizations have no legitimate need for open, any-tenant external chat, Arctic Wolf says. Per Microsofts guidance in Manage external meetings and chat with people and organizations using Microsoft identities, move from allow all to an allow-list of trusted organizations.

The second crucial step is educating the employees. Everyone should be made aware of the fact that just because a message came from Teams, it doesnt mean its legitimate. Same goes for an audio call, or an email. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/watch-out-that-microsoft-teams-chat-mig ht-be-hackers-impersonating-your-it-support


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)