Fake IT Support Uses Spam and Teams to Trap Staff

This weekly roundup describes real social-engineering operations in which attackers impersonated IT help desk staff. They used phone calls, email, and Microsoft Teams to persuade employees to open remote-access sessions; another campaign first overwhelmed inboxes with spam, then offered fake support through Teams.

Key findings

• Cisco Talos Incident Response observed attackers posing as IT help desk staff across several real-world engagements in the third quarter of 2026.
• The attackers contacted employees through phone calls, email, and Microsoft Teams and persuaded them to open remote-access sessions.
• In one Talos case, the remote access obtained through the help desk impersonation led to ransomware.
• Arctic Wolf documented more than 400 incidents involving abuse of Microsoft Teams' external chat feature.
• In the Teams campaign, attackers flooded inboxes with spam and then posed as IT support offering to resolve the disruption they had caused.

Who’s being targeted

• Commonly targeted roles: All employees, Microsoft Teams users, Remote workers, IT help desk staff, Employees authorized to use remote-access tools.
• Affected industries: Cross-industry organizations using Microsoft Teams, Organizations with employee help desk and remote-access workflows.
• Attack channels: vishing, email, teams.
• Impersonated: Internal IT help desk staff, IT support.

Awareness takeaways

• Do not open a remote-access session because of an unsolicited call, email, or chat. End the interaction and contact IT through the organization’s known support portal or published phone number.
• Treat unsolicited external Microsoft Teams chats claiming to be IT support as suspicious, especially after an unusual spam surge.
• Teach employees that attackers can use a disruption they created, such as a spam flood, as proof that their fake support offer is legitimate.

Red flags to watch for

• The caller asks the employee to initiate a remote-access session.
• The request was not made through a known internal support channel.
• The caller relies on basic employee information, such as a name and email address, to appear legitimate.
• A sudden flood of spam is followed by an unsolicited support contact.
• The supposed support worker contacts the employee through an external Teams chat.
• The sender offers help for a problem that they may have deliberately created.