Fake IT Support Calls in Teams Lead to Ransomware

How the attack worked

This campaign, tracked as STAC4749, began with first contact through Microsoft Teams chats and calls in which operators impersonated helpdesk or IT support staff. The pretext was simple: a support issue needed fixing, and the target had to start a remote session. Operators created IT-themed cloud domains under the ".top" top-level domain and used plausible employee usernames to make their accounts look legitimate to targets who had no reason to doubt an internal IT contact.

Once a remote session was underway, either through an existing remote-access tool or one the victim was persuaded to download, the operators launched PowerShell on the compromised system. This was used to retrieve and execute malicious payloads hosted on attacker-controlled web servers. These payloads were typically staged in user-writable directories, most commonly AppData\Roaming, which let the activity blend into normal user file locations rather than requiring elevated access.

Why it succeeded

The attack relied on a pretext that employees encounter regularly: an IT support request. Because it arrived through Teams, a trusted internal collaboration tool, and used a professional-sounding username plus a domain designed to look IT-related, it bypassed the skepticism that might apply to an unfamiliar email or phone number. The request to start a remote session or install a tool did not necessarily look out of place if the target believed they were speaking with real IT staff.

What to watch for

• Unsolicited Teams chats or calls claiming to be IT support, especially from external accounts
• Usernames or domains tied to unusual top-level domains like ".top"
• Pressure to start a remote session or install new remote-access software during the interaction
• PowerShell execution or downloads occurring shortly after a remote session begins
• Files appearing in user-writable locations such as AppData\Roaming

How to build resistance

Organizations affected spanned services, manufacturing, energy, construction and engineering, and legal services, showing this pretext can reach nearly any employee, not just technical staff. Because at least three compromises led to Chaos ransomware deployment, in one case less than 17 hours after initial access, the window to detect and stop this activity is short.

Defenders should train employees to treat unsolicited IT support contact on Teams as unverified until confirmed through a known internal channel, such as a direct call to the IT helpdesk using a number already on file. Staff should also be reminded that legitimate IT support rarely requires urgent action mid-chat, and that new remote-access tools should never be installed without separate confirmation. Reporting suspicious remote-support requests immediately, rather than after the fact, gives security teams a better chance to intervene before payloads execute.

How did attackers gain initial access in this Teams vishing campaign?

Attackers made first contact through Teams chats and calls, impersonating helpdesk or IT support staff, and used IT-themed ".top" domains with plausible employee usernames to appear legitimate.

What did attackers do after gaining remote access?

They launched PowerShell on the compromised system to retrieve and execute malicious payloads from attacker-controlled web servers, typically staged in user-writable directories like AppData\Roaming.

How fast did ransomware follow after the initial compromise?

In at least three compromises, attackers deployed Chaos ransomware, with one case occurring less than 17 hours after initial access.

Who is most likely to be targeted by this type of attack?

The campaign hit dozens of organizations across services, manufacturing, energy, construction/engineering, and law firms, with all employees and IT helpdesk staff being common targets.