Cyber Attackers Impersonate IT Staff on Microsoft Teams
A new threat report reveals that attackers are posing as internal IT workers to compromise employee accounts via workplace apps.
Updated on Oct. 21, 2026 in Cybersecurity
Live Poll
Do you feel confident in your ability to verify the identity of someone requesting remote computer access?
Approximately 30% of organizations monitored by Ontinue faced attempts to impersonate IT support on Microsoft Teams during the first half of 2026. Criminals are tricking employees into running commands or authenticating sessions to bypass password requirements.
Why it matters
By hijacking trusted communication tools, attackers successfully blend in with legitimate workplace traffic to bypass standard security filters. These techniques allow malicious actors to gain unauthorized account access while avoiding immediate detection by IT staff.
Researchers identified 10 confirmed device-code phishing compromises across five customer tenants using these methods. Additionally, attackers utilized blockchain-based infrastructure for more than 25% of confirmed malicious ClickFix findings.
The players
Ontinue
Ontinue is a managed detection and response provider that monitors organizational networks for security threats.
Black Basta
Black Basta is a prominent cybercriminal group known for deploying ransomware and developing sophisticated intrusion tactics.
The details
Attackers pose as IT support through Microsoft Teams to guide users toward running PowerShell commands or opening Windows Quick Assist. This process tricks employees into completing a secondary authentication step, granting the attacker account access without needing a password.
Timeline
2024: The Black Basta ransomware group popularized these specific attack techniques.
First half 2026: 30% of monitored organizations experienced Teams impersonation attempts.
May to June 2026: Researchers identified 10 confirmed device-code phishing compromises.
October 21, 2026: Ontinue released the threat intelligence report.
The Tech Race
This activity follows the rise of Black Basta-style social engineering, marking a shift toward abusing trusted internal communication platforms. These attacks replace traditional broad-spectrum malware with targeted deception that exploits the inherent trust in workplace messaging systems.
Employees should be wary of any unsolicited IT support requests via workplace chat apps that ask for sensitive authentication or command execution. Organizations can mitigate these risks by enforcing stricter device-code policies and verifying the identity of support personnel through established internal channels.
The takeaway
The most effective defense against these attacks is to treat all unexpected IT support messages with skepticism regardless of the platform. Always verify help desk requests through your company's official ticketing system or a known, verified phone number before performing any actions on your device.
Further reading
For additional context on protecting corporate infrastructure, visit the Cybersecurity section.
Source note: This article includes information reported by THE Journal.
Live Poll
Do you feel confident in your ability to verify the identity of someone requesting remote computer access?
