Science & Tech · Cybersecurity · 3 hrs ago
Attackers impersonate IT support in Microsoft Teams to gain remote access
Attackers are using Microsoft Teams to pose as company IT support and gain access to employees’ devices.
Cybersecurity researchers at Arctic Wolf observed the pattern in more than 400 incidents affecting organizations.
The scam often begins with a flood of junk emails that overwhelms an employee’s inbox.
A fake support account then contacts the employee on Teams and offers help with the email problem.
The attacker persuades the employee to use legitimate remote-access tools, including Windows Quick Assist, and may install another tool to keep access.
Some attacks reached malware execution in under 15 minutes, and researchers say attackers may use that access for further network activity or ransomware.
Teams allows external chats by default, so Arctic Wolf recommends organizations restrict contact to approved external domains; the researchers did not identify who was behind the campaign.
Arctic Wolf researchers reported more than 400 incidents involving attackers who used Microsoft Teams external chats to impersonate IT support.
The attackers often flooded employees’ inboxes with spam before contacting them on Teams and offering help.
Victims were persuaded to grant remote access through legitimate tools such as Quick Assist, AnyDesk or ScreenConnect.
In some cases, attackers executed malware, stole credentials, conducted reconnaissance or moved through the target network.
Researchers said payload execution could occur in under 15 minutes after a victim engaged with the initial message.
- Who
- Threat actors impersonating IT support. Arctic Wolf researchers observed the activity.
- What
- Attackers used Teams external chats and email bombing to trick employees into granting remote access.
- When
- Researchers reported the campaign in October 2026; the incidents were observed across more than 400 cases.
- Where
- Organizations using Microsoft Teams with external access enabled.
- Why
- To gain access to organizations and, in some cases, execute malware, steal credentials, conduct reconnaissance or deploy ransomware.
This story does not have two clearly opposing sides.
Attackers flooded a victim’s inbox with newsletter or subscription messages, creating a sense of urgency.
An external Teams user impersonating IT support contacted the victim and offered to resolve the email problem.
Attackers persuaded the victim to grant remote access using tools such as Quick Assist.
In reported cases, the attack chain could reach payload execution within this time after the victim engaged with the initial message.
Arctic Wolf’s report on the activity was published.
- Observed incidents
- More than 400
- Payload execution
- Under 15 minutes after a victim engages with the initial message
- Default Teams setting
- External access is turned on by default
- onmicrosoft.com tenants
- 30–40% of cases, according to Arctic Wolf
- Paid domains using .top
- Approximately 50% of observed cases involving paid domains, according to Arctic Wolf
4 sources
Watch out — that Microsoft Teams chat might be hackers impersonating your IT support
External Teams Chats Anchor 15-Minute Malware Delivery
Attackers Exploit Teams External Chat to Breach Organizations in Under 15 Minutes
Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
What people are saying
A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same 'IT Support (Internal)' display names, the same remote-access tools, and increasingly, the same payload domains
Across the activity examined, attackers combined email bombing, convincing IT-support impersonation, newly created tenants and domains, and rapid social engineering to move victims from a seemingly routine chat to remote access, payload execution, and, in some cases, broader compromise
This activity does not exploit any known Teams vulnerability; it abuses a legitimate, default-on collaboration capability