This threat report describes more than 400 real incidents in which attackers used Microsoft Teams external chat to impersonate internal IT support staff. Employees were persuaded to start remote sessions and install access tools, with some cases leading to stolen credentials, movement across company systems, and ransomware-related activity.
In this campaign, attackers reached employees through Microsoft Teams external chat rather than email or phone calls. They posed as internal IT support personnel and opened conversations with messages like a request to start a remote session so they could assist with a device issue. Once the employee agreed, the attacker guided them into installing a remote-access tool, giving the attacker a foothold on the device. Researchers tied this approach to more than 400 documented incidents, and in some cases the access was used to steal credentials, move laterally across internal systems, and carry out ransomware-related activity.
The scam worked because it exploited trust in a familiar workplace tool. Employees are used to receiving legitimate IT support requests through Teams, so a chat message claiming the same origin did not immediately stand out, even though the sender was external rather than an internal colleague. The request to start a remote session or install software is also something employees may have done before with real IT staff, making the ask feel routine rather than suspicious. The medium itself, an internal-feeling chat platform, lowered the usual skepticism people might apply to unsolicited emails or phone calls.
Organizations and employees can reduce exposure to this type of scam with a few consistent habits. Treat any unsolicited Teams message claiming to be IT support as suspicious, particularly when the platform flags the sender as external. Before starting a remote session or installing any tool requested through chat, independently contact IT support through the established internal channel to confirm the request is legitimate. Encourage employees to report suspicious IT-support style messages quickly, since what starts as a simple chat request can, in some cases, progress to credential theft and ransomware-related activity if left unaddressed. These habits target the specific technique used here: impersonation through a trusted internal-feeling channel (see attack.mitre.org/techniques/T1566/003 and attack.mitre.org/techniques/T1656).
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers used Microsoft Teams external chat functionality to contact employees while impersonating internal IT support personnel, then persuaded them to start remote sessions and install access tools.
In some documented incidents, the initial access led to credential theft, lateral movement across systems, and ransomware-related activity.
Researchers documented more than 400 real incidents involving abuse of Microsoft Teams external chat functionality for initial access.
A chat message claiming to be from internal IT support that actually arrives from an external Teams user and asks the employee to start a remote session or install software.
“Internal IT Support” just messaged you on Teams. Look closer. It says, “We need you to initiate a remote session so we can assist with your device.” Next comes a request to install an access tool. Here’s the giveaway: Teams marks the sender “External.” That’s not your internal IT team. This trick appeared in over 400 incidents; some led to stolen credentials and ransomware activity. Before starting any remote session, contact IT yourself through your approved support channel.
Attackers are using Microsoft Teams external chat to pose as internal IT support staff, often after overwhelming employees with email subscription messages. They persuade victims to join a voice call, approve remote-control tools, or run commands, with some incidents ending in malware infections…
Attackers impersonated IT help desk staff through phone calls, email, and Microsoft Teams, using employees’ names and email addresses to appear legitimate. They persuaded users to open remote-access sessions, and one such session led to a ransomware incident. The campaigns did not focus only on…
Microsoft is adding AI-based phishing detection to Teams after attackers repeatedly used external chats to impersonate support staff, send malicious files, and deliver fake billing notices. The reported attacks exploit Teams' default external-access feature rather than a software flaw, making…
Attackers overwhelm employees with hundreds of spam messages, then contact them through Microsoft Teams while posing as internal IT support. They offer to fix the inbox problem, move victims into a voice call, and persuade them to install or use remote-access tools such as Quick Assist. The scams…
Attackers are posing as internal IT support staff in Microsoft Teams, often after flooding an employee’s inbox with subscription emails to create urgency. They persuade victims to grant remote access through legitimate support tools, then install malware, steal information, and in some cases deploy…
Microsoft reports that North Korean threat actors are using AI to make job scams, fake recruiter outreach, fraudulent worker identities, and targeted phishing campaigns faster and more convincing. One group posed as recruiters for a spoofed AI blockchain company and scheduled software-engineer…
