Hackers use Microsoft Teams messages and calls to gain remote access
Attackers impersonate IT support via Teams to approve Quick Assist sessions and abuse AD CS for privileged account access.
1
Stories per day · 30 days
2 RSS
Relatedmicrosoft-teams8social-engineering5ad-cs3vishing3it-support-scam2ransomware2remote-access2active-directory1black-basta1byovd1dcsync1email-bombing1esc11esc81help-desk1help-desk-scam1initial-access1kerberoasting1
15 stories, newest first · one card per story
Stories tagged #quick-assist
Fake Teams IT help desk sessions abused AD CS for domain access
Two Microsoft-disclosed intrusions used Quick Assist plus ESC1 or ESC8, then DCSync and Rclone in one case.
2
Teams help-desk lures led to AD CS ESC1 and ESC8 abuse
Two unattributed intrusions used Quick Assist; one reached DCSync and exfiltration after a privileged identity was excluded from containment.
Fake IT help desk calls led to remote access and VYPR ransomware
Cisco Talos says callers often knew only names and emails, and one Quick Assist session ended in ransomware.
Email bombing and external Teams chats used for remote access
Arctic Wolf reports the pattern in more than 400 incidents, with Quick Assist most often used before credential theft.
1
Spam floods precede fake IT-support chats in Microsoft Teams
Arctic Wolf documented more than 400 cases; remote-access tools can be installed in under 15 minutes, sometimes leading to ransomware.
1
Attackers abuse Teams external chat to breach organizations quickly
Arctic Wolf saw more than 400 cases, often with email bombing and Quick Assist, and did not name the operators.
2
Fake Microsoft Teams IT support used for remote access and malware
Arctic Wolf tied more than 400 cases to external chats, inbox floods, and tools such as Quick Assist, sometimes within 15 minutes.
1
Ransomware Leverage is Growing by the Terabyte: Takeaways from ThreatLabz 2026 Ransomware Report
Zscaler ThreatLabz reports top ransomware groups' exfiltrated data volume jumped 276% year-over-year to 896 TB despite payments falling to $327.8M.
1
Hackers Impersonate IT Help Desk on Microsoft Teams to Steal Windows Passwords
Attackers impersonate IT help desks in Microsoft Teams to deliver SynkLoader and steal Windows passwords.
2
Hackers Abuse Microsoft Teams to Pose as IT Support and Steal Employee Passwords
Threat actors impersonate IT support in Microsoft Teams chats to deliver SynkLoader malware and harvest Windows credentials via fake lock screens.
1
Hackers Impersonate IT Support on Microsoft Teams to Take Control of Employee PCs
Microsoft warns of a human-operated campaign where attackers pose as IT support in Teams to gain remote PC control and reach domain controllers.
4
Modified ScreenConnect Clients Used in Worm-Like Campaign
Huntress warns of worm-like attacks using modified ScreenConnect clients to spread VBScript payloads; ConnectWise issued an advisory.
1
Impersonating IT support: how threat actors turn a remote session into enterprise-wide access
Microsoft details Teams IT-support impersonation campaigns deploying Node.js implants, AD reconnaissance, and WinRM lateral movement toward domain controllers.
5
Vishing campaign abuses Microsoft Teams to give attackers a foothold in company networks
Unit 42 details 'Spring Ring', a vishing campaign using fake IT support on Microsoft Teams to reach 150+ employees at 10+ companies.
2