Teams help-desk lures led to AD CS ESC1 and ESC8 abuse
Two unattributed intrusions used Quick Assist; one reached DCSync and exfiltration after a privileged identity was excluded from containment.
73
Product
Quick Assist
- Mentions · 7d7
- Mentions · 30d7
- All mentions13
- First seenSep 1, 2026
- Last mentioned15h ago
Timeline
13 articles · newest firstEmail bombing and external Teams chats used for remote access
Arctic Wolf reports the pattern in more than 400 incidents, with Quick Assist most often used before credential theft.
68
Spam floods precede fake IT-support chats in Microsoft Teams
Arctic Wolf documented more than 400 cases; remote-access tools can be installed in under 15 minutes, sometimes leading to ransomware.
64
Attackers abuse Teams external chat to breach organizations quickly
Arctic Wolf saw more than 400 cases, often with email bombing and Quick Assist, and did not name the operators.
76
Fake Microsoft Teams IT support used for remote access and malware
Arctic Wolf tied more than 400 cases to external chats, inbox floods, and tools such as Quick Assist, sometimes within 15 minutes.
76
Attackers impersonate IT support on Microsoft Teams to gain remote access
An October 26 Arctic Wolf report on more than 400 incidents also describes a PowerShell and MSI infection chain.
76
Teams IT-support impersonation used to deploy malware and ransomware
Arctic Wolf ties hundreds of cases to throwaway Microsoft 365 tenants, mail bombing, RMM tools, and sometimes Chaos ransomware.
74
Hackers Impersonate IT Help Desk on Microsoft Teams to Steal Windows Passwords
Attackers impersonate IT help desks in Microsoft Teams to deliver SynkLoader and steal Windows passwords.
74
Hackers Impersonate IT Support on Microsoft Teams to Take Control of Employee PCs
Microsoft warns of a human-operated campaign where attackers pose as IT support in Teams to gain remote PC control and reach domain controllers.
68
Modified ScreenConnect Clients Used in Worm-Like Campaign
Huntress warns of worm-like attacks using modified ScreenConnect clients to spread VBScript payloads; ConnectWise issued an advisory.
66
Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
Huntress observed rogue ScreenConnect deployments with worm-like VBScript propagation across unrelated organizations, prompting a ConnectWise advisory on file transfer behavior.
78
Impersonating IT support: how threat actors turn a remote session into enterprise-wide access
Microsoft details Teams IT-support impersonation campaigns deploying Node.js implants, AD reconnaissance, and WinRM lateral movement toward domain controllers.
82
Vishing campaign abuses Microsoft Teams to give attackers a foothold in company networks
Unit 42 details 'Spring Ring', a vishing campaign using fake IT support on Microsoft Teams to reach 150+ employees at 10+ companies.
60
Appears with
- Microsoftvendor · 12
- Microsoft Teamsproduct · 11
- ScreenConnectproduct · 8
- AnyDeskproduct · 6
- Arctic Wolforganization · 5
- Chaosmalware · 3
- TeamViewerproduct · 3
- Huntressorganization · 2
- Black Bastathreat actor · 2
- Node.jsproduct · 2
- Huntressvendor · 2
- Sophosorganization · 2
- ConnectWiseorganization · 2
- Ateraproduct · 2
- Microsoft 365product · 2
- ConnectWisevendor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.