Teams help-desk lures led to AD CS ESC1 and ESC8 abuse
Two unattributed intrusions used Quick Assist; one reached DCSync and exfiltration after a privileged identity was excluded from containment.
73
Product
Microsoft Teams
- Mentions · 7d13
- Mentions · 30d31
- All mentions67
- First seenAug 18, 2026
- Last mentioned15h ago
Timeline
67 articles · newest firstFake IT help desk calls led to remote access and VYPR ransomware
Cisco Talos says callers often knew only names and emails, and one Quick Assist session ended in ransomware.
68
Canadian help-desk vishing campaign bypasses MFA in real time
Callers send staff to branded relay pages, then register MFA methods and steal Microsoft 365 data before extortion.
72
Digitate’s ignio Hummingbird adds AI agents for patches, desks and SAP
The agents diagnose issues, act only under enterprise approval and verify results via MCP and Agent2Agent.
24
Email bombing and external Teams chats used for remote access
Arctic Wolf reports the pattern in more than 400 incidents, with Quick Assist most often used before credential theft.
68
Spam floods precede fake IT-support chats in Microsoft Teams
Arctic Wolf documented more than 400 cases; remote-access tools can be installed in under 15 minutes, sometimes leading to ransomware.
64
Attackers abuse Teams external chat to breach organizations quickly
Arctic Wolf saw more than 400 cases, often with email bombing and Quick Assist, and did not name the operators.
76
Fake Microsoft Teams IT support used for remote access and malware
Arctic Wolf tied more than 400 cases to external chats, inbox floods, and tools such as Quick Assist, sometimes within 15 minutes.
76
Attackers impersonate IT support on Microsoft Teams to gain remote access
An October 26 Arctic Wolf report on more than 400 incidents also describes a PowerShell and MSI infection chain.
76
Microsoft restores Teams after US disruption tracked as TM1526111
Automatic scaling returned throughput to healthy levels on October 26, but Microsoft has not named the trigger, user count or affected features.
34
Teams IT-support impersonation used to deploy malware and ransomware
Arctic Wolf ties hundreds of cases to throwaway Microsoft 365 tenants, mail bombing, RMM tools, and sometimes Chaos ransomware.
74
Android Authenticator flaw let apps steal work tokens
An installed app with no permissions could impersonate Teams and obtain Graph tokens; fixed in 6.2606.4246.
66
Microsoft Teams will use AI to detect phishing in external chats
Targeted Release runs through mid-November and worldwide availability is set for mid-December, with no admin setup required.
52
Microsoft Teams to get AI-powered, context-aware phishing detection
Admins need not enable it, and Microsoft says message content is not kept for model training.
46
ConnectWise Cloud Backup API secret used against Microsoft 365 tenants
Huntress saw malicious sign-ins across almost 1,000 Entra tenants, with more than 300 appearing to succeed.
78
Zscaler says ransomware gangs use AI to select data for extortion
ThreatLabz cites 896.2 TB stolen by the top 10 groups and a healthcare payment of $2 million with no encryption.
58
ConnectWise suspends cloud services after M365 tenant access
Huntress says a Cloud Backup client assertion reached 162 Microsoft 365 tenants on October 15–16.
78
Five-day-old domain copies Microsoft Teams login, researcher warns
Steven Lim flagged teams-cloud.live on October 18 and urged blocking; captured passwords and malware are unconfirmed.
46
Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
Hackers abused ConnectWise Cloud Backup identities to access at least 162 Microsoft 365 tenants.
82
Midnight Blizzard-Linked Malware Server Still Delivering Payloads 8 Weeks After Disclosure
ReversingLabs found a Midnight Blizzard-linked server still serving ChocoShell and CornFlake on October 5.
64
Midnight Blizzard-Linked Hackers Use Claude AI to Rebuild Malware and Evade Detection
Midnight Blizzard-linked operators used Claude to rebuild ChocoShell and CornFlake malware against Ukrainian and European targets.
78
Hackers Use ClickFix and Python Tunnels to Prepare Systems for Ransomware Attacks
Forescout says ClickFix installed Lorem Ipsum Loader and a Python tunnel before suspected ransomware was stopped.
64
New ClickFix Attack Deploys Lorem Ipsum Malware Loader to Establish Remote Access
A ClickFix campaign uses the Lorem Ipsum loader to install a Python tunnel for covert remote access.
61
Microsoft Teams Adds New Security Feature to Detect Malicious QR Codes in Messages
Microsoft Teams will warn users when Defender detects malicious URLs embedded in QR codes in messages.
48
Microsoft Teams to Warn Users About Malicious Links Hidden in QR Codes
Microsoft Teams will warn users when Defender finds malicious URLs hidden inside QR codes.
48
Microsoft Teams to Introduce Deepfake Detection to Identify AI-Generated Audio and Video in Meetings
Microsoft Teams will integrate third-party signals to flag AI-generated audio and video in meetings from November 2026.
44
Lawmakers warn Google could expose Spirit Airlines data in $10 million AI training deal
Lawmakers urged Google and Spirit to halt a $10 million AI-training data deal over re-identification risks to employee records.
62
Microsoft Teams Adds Synthetic Audio and Video Detection to Fight Deepfake Meeting Attacks
Microsoft Teams will surface third-party synthetic audio and video detection, with rollout planned from November 2026.
41
Hackers Registered New Domain with Exact Microsoft Teams Interface to Steal Logins
A four-day-old domain, teams-online.com, clones the Microsoft Teams login page to steal work credentials.
41
Cybersecurity Awareness Month 2026 – Don’t Make It Easy for Them
Awareness Month 2026 warns that AI phishing, QR codes, and ClickFix are driving everyday account attacks.
44
Meta, OpenAI and Uber Just Taught AI Agents to Talk First. What About When to Stay Quiet?
Meta Muse, OpenAI Dots, and Uber's driver assistant push proactive messages, raising when agents should interrupt.
40
Hackers Target 5,700 Microsoft 365 Accounts Using Forgotten Service Accounts With No MFA
Proofpoint says UNK_CondorFiltration password-sprayed 5,700 Microsoft 365 accounts and breached seven MFA-less service accounts in Chile.
74
OpenAI's reveals a new ChatGPT that looks less like a chatbot and more like an operating system
OpenAI's DevDay turns ChatGPT into a workspace with plugins, shared Spaces, and Slack and Teams integration.
74
OpenAI launches Dots, its Muse competitor
OpenAI launched Dots, GPT-6 Astra-powered always-on agents that work across apps, starting with Pro and Business Premium.
76
Microsoft thinks its new Copilot ‘super app’ will be as influential as Office
Microsoft unveiled a Copilot super app bundling chat, coding, and Autopilot agents with usage-based enterprise billing.
72
Ando wants to take on Slack with a team messaging app that lets humans and agents work together
Ando left stealth with $20 million to build team chat where AI agents work beside humans.
44
How device code phishing gives scammers access to your account
Device code phishing tricks users into approving a real OAuth sign-in, handing attackers account tokens.
46
Teams meeting audio and roster data remain accessible via ACS Call Automation connectCall after a participant is removed from the meeting
Teams meeting audio and roster stay reachable via ACS Call Automation after a participant is removed.
52
Hackers Impersonate IT Help Desk on Microsoft Teams to Steal Windows Passwords
Attackers impersonate IT help desks in Microsoft Teams to deliver SynkLoader and steal Windows passwords.
74
Microsoft Investigating Teams Calling Issue Blocking Some Users From Making or Receiving Calls
Microsoft is investigating a Teams incident blocking some users from making or receiving calls.
30
Related CVEs
by mentions- CVE-2026-835488%10.0Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface
- CVE-2026-958619%9.3Unauthenticated SQL Injection RCE in Sangoma Switchvox SMB Edition
- CVE-2026-8354910%7.8Authenticated OS Command Injection RCE in SonicWall SMA1000 Appliance Console
- CVE-2026-80097<1%8.6Improper Authentication in Microsoft Authenticator Enables Local Privilege Escalation
- CVE-2026-62911<1%8.0Capture-Replay Authentication Bypass in Microsoft Exchange Server
- CVE-2023-52271<1%6.5The wsftprm.sys kernel driver 2.0.0.0 in Topaz Antifraud allows low-privileged attackers to kill any (Protected Process Light) process via an IOCTL (which will…
- CVE-2025-1055<1%5.6A vulnerability in the K7RKScan.sys driver, part of the K7 Security Anti-Malware suite, allows a local low-privilege user to send crafted IOCTL requests to…
- CVE-2025-61155<1%5.5The GameDriverX64.sys kernel-mode anti-cheat driver (v7.23.4.7 and earlier) contains an access control vulnerability in one of its IOCTL handlers
Appears with
- Microsoftvendor · 62
- Microsoftorganization · 18
- Microsoft 365product · 17
- Quick Assistproduct · 11
- AnyDeskproduct · 7
- ScreenConnectproduct · 7
- SharePointproduct · 5
- OpenAIorganization · 5
- OneDriveproduct · 5
- Node.jsproduct · 5
- Arctic Wolforganization · 5
- DocuSignvendor · 5
- PowerShellproduct · 4
- Slackproduct · 4
- Exchange Onlineproduct · 4
- TeamViewerproduct · 4
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.