Fake IT Help Desk Scams on Microsoft Teams Lead to Breaches: New Analysis of 400+ Incidents

On October 26, Arctic Wolf published an analysis of more than 400 incidents in which attackers used external Microsoft Teams chats. The attackers posed as the company’s own IT help desk and talked employees into sharing their computers. The new report describes the recurring infrastructure behind these attacks and how they’re run.

How the scam works

The first contact usually comes right after the victim’s inbox has been flooded with unwanted messages. Then someone claiming to be from IT reaches out on Teams and offers to fix the problem. The account comes from an outside Microsoft 365 tenant, but its name makes it look like the company’s internal support team.

Attackers use display names such as “IT Support (Internal),” even though Teams flags the contact as external. Their goal is remote access through legitimate tools such as Quick Assist, AnyDesk, or ScreenConnect. They can then use that access to install malware.

Who is at risk

Any organization that allows external chats in Teams is exposed. The risk is highest where employees normally get IT help through the chat app. The analysis describes abuse of a collaboration feature and of users’ trust. It is not a new vulnerability, so there’s no software patch to install.

The researchers also note that attackers may download more tools during the remote session itself. Checking the links sent in the chat isn’t enough to cover the whole attack.

What to do now

• Review your Teams external access policies and limit external access to the partners your business actually needs.
• Set up a simple way to confirm that someone really works in IT, such as a known phone number or the company ticketing system.
• Restrict the use of unapproved remote access tools.
• When a user’s inbox is suddenly flooded with messages, warn them that a fake “tech support” contact may follow.
• If an employee has shared their computer with someone they don’t know, preserve the session logs and hand the case to your incident response team.

SecurHUB’s take

Your IT support verification process has to hold up even when a user is under pressure and wants their email back fast. A 24/7 SOC can help investigate suspicious remote sessions and related activity on user devices and accounts.

Sources: Arctic Wolf, Techzine