Attackers Use Microsoft Teams to Impersonate IT Support
Threat actors are exploiting the Microsoft Teams platform to gain unauthorized remote access to corporate systems.
Updated on Oct. 27, 2026 in Cybersecurity
Live Poll
Do you trust the security of internal messaging tools for verifying help desk requests?
Hackers are flooding inboxes with spam before contacting victims via Microsoft Teams to pose as IT support. The scammers convince users to provide a six-digit code that grants them full remote control over corporate devices.
Why it matters
Employees are often more inclined to trust internal communication tools like Teams compared to email, making them vulnerable to this social engineering tactic. Microsoft Teams ships with external access enabled by default, which attackers abuse to contact unsuspecting workers.
Attackers use automation to target multiple users within five-minute windows to avoid security alerts. Malicious code execution occurs within 15 minutes, often involving the installation of Python implants to scrape Active Directory data.
The players
Arctic Wolf
Arctic Wolf is a security operations firm that provides managed detection and response services for corporate clients.
Microsoft Teams
Microsoft Teams is a proprietary business communication platform that integrates chat, video meetings, and file storage for organizations.
The details
Once inside a system, intruders use legitimate remote access tools like Quick Assist, AnyDesk, and ScreenConnect to steal data or deploy ransomware. By using free onmicrosoft.com tenants and spoofed display names, attackers successfully bypass traditional automated security scanning.
Timeline
Microsoft first documented this social engineering technique in mid-2024.
This report on the ongoing campaign was published on October 27, 2026.
The Tech Race
This trend marks a shift toward leveraging trusted collaboration platforms to bypass perimeter security measures. It forces IT departments to reconsider the balance between seamless external connectivity and the risk of automated social engineering campaigns.
Users should be wary of any unexpected messages appearing in Teams, even if they appear to originate from internal IT staff. Never share your remote access codes with anyone unless you have independently verified their identity through an official secondary channel.
The takeaway
Adopt a zero-trust mindset when receiving support requests through messaging apps, treating them with the same caution as unsolicited emails. Always verify the sender's identity through a pre-established internal directory or phone number before granting access to your machine.
Further reading
Learn more about securing your corporate communication channels in our Cybersecurity section.
Live Poll
Do you trust the security of internal messaging tools for verifying help desk requests?
