Technology Miraj Islam October 27, 2026 0 Comments

Beware: Microsoft Teams chat could be from hackers posing as your IT support

Add us as a preferred source on Google

Subscribe to our newsletter

Attackers flood inboxes with spam and then impersonate IT support via Microsoft Teams messages and calls.
Victims are tricked into sharing remote access via Quick Assist, AnyDesk or ScreenConnect
Researchers looked at more than 400 incidents and warned that the default Teams federation settings allow the social engineering campaign.

Cybersecurity researchers Arctic Wolf have warned of a widespread and ongoing hacking campaign that includes an email inbox flooded with spam messages, a Teams account posing as IT support, and the use of absolutely legitimate everyday software.

The goal appears to be persistent access, possibly in preparation for a subsequent malware or ransomware infection.

How the attack develops

In its report, Arctic Wolf said it observed the same pattern in more than 400 cases. It begins when the victim, an employee of the targeted company, receives hundreds, possibly thousands of spam emails in a very short period of time, causing their inbox to become completely flooded with junk, burying each and every valuable and significant email under a mountain of junk.

Latest videos ofTechnologyRadar

A few moments later, that same person receives a Teams message from a user who, by all accounts, looks legitimate: Their name clearly says “IT Service Desk,” and sometimes it even has a name next to it (something like Liam, Ethan, or Scott). They tell the victim that they have been informed of the problems they are having with their email (as the IT department should) and offer a solution.

To resolve the issue, they need hands-on access to the victim’s keyboard, usually through a legitimate remote management and monitoring tool like AnyDesk or ScreenConnect.

Obviously, all this is a ruse to get the victim to give up access to their device. The same entity sent both the spam emails and the Teams messages. Sometimes they even call the victim through Teams, instead of sending them a message, to make the whole thing even more believable.

Arctic Wolf says the key factor in the whole scheme is the fact that Microsoft Teams ships with external access (federation) enabled by default. That means that unless the actual IT team changes the default settings in Teams, each employee can receive messages from anyone else with a Microsoft 365 account, even if they belong to a completely different tenant (dedicated environment within Microsoft cloud services). Unfortunately, this is not a bug, it is a completely legitimate feature that threat actors happily exploit:

“This is the feature that attackers most often abuse,” says Arctic Wolf. “This activity does not exploit any known Teams vulnerability; it abuses a legitimate, default collaboration capability.”

Lock your devices

To make matters worse, when they request hands-on access, they do not ask the victim to install any special software. In most cases, they simply ask them to open Quick Assist, a tool built directly into Windows, signed by Microsoft and therefore does not require installation. All victims have to do is submit a six-digit code and they will be handed the keys to the kingdom.

What will happen after that is anyone’s guess. Researchers saw attackers install a commercial RMM tool such as AnyDesk or ScreenConnect to gain a separate control channel and ensure access is retained even if Quick Assist is revoked. They would then map the target IT network and perform as much reconnaissance as possible, likely in preparation for a ransomware or malware attack.

Defending against these types of attacks starts by closing the proverbial doors to Teams. “Most organizations don’t have a legitimate need to have an open, all-tenant external chat,” says Arctic Wolf. “According to Microsoft’s guidance in Manage external meetings and chat with people and organizations using Microsoft identities, switch from “allow everyone” to an allowed list of trusted organizations.”

The second crucial step is to educate employees. Everyone should be aware of the fact that just because a message comes from Teams does not mean it is legitimate. The same goes for an audio call or an email.