Fake Microsoft Teams IT support used for remote access and malware
Arctic Wolf tied more than 400 cases to external chats, inbox floods, and tools such as Quick Assist, sometimes within 15 minutes.
76
- Mentions · 7d2
- Mentions · 30d2
- All mentions5
- First seenAug 18, 2026
- Last mentioned5d ago
Timeline
5 articles · newest firstAttackers impersonate IT support on Microsoft Teams to gain remote access
An October 26 Arctic Wolf report on more than 400 incidents also describes a PowerShell and MSI infection chain.
76
Major Cyber Attacks in September 2026: US Organizations Face Session Theft, Remote Access, and Payment Fraud
September campaigns CSuite, N0va, and IronToll phished US organizations for Microsoft 365 sessions, tokens, and payment data.
70
CSuite Targets US and EU Organizations with Device-Code Phishing and Remote Access
CSuite targets US and EU organizations with device-code phishing and remote access. 60% of identified victims are US-based; 351 related sandbox analyses detected; 23 modules in the phishing panel.
90
More than 200 victims of Medusa ransomware identified over the last year, CISA says
CISA and FBI update Medusa ransomware advisory, reporting more than 500 total victims and warning the gang operationalizes newly disclosed exploits within 24 hours.
70
Appears with
- Microsoftvendor · 5
- ScreenConnectproduct · 4
- AnyDeskproduct · 3
- TeamViewerproduct · 2
- Action1product · 2
- Quick Assistproduct · 2
- Arctic Wolforganization · 2
- Microsoft Teamsproduct · 2
- PDQ Connectproduct · 2
- DocuSignproduct · 1
- SimpleHelpproduct · 1
- Google Meetproduct · 1
- Microsoft 365product · 1
- Google Meetorganization · 1
- CSuitethreat actor · 1
- Splashtopproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.