Attackers used external Microsoft Teams chats to impersonate internal IT support and convince employees to grant remote access to their Windows computers. In many cases, they first flooded inboxes with subscriptions or confirmation emails, then offered fake assistance and persuaded victims to use remote-support tools or run PowerShell commands that installed malware.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Hundreds of newsletter emails, then a Teams message: “I can help.” It says “IT Support (Internal),” but Teams marks the sender external. They offer to fix the flood, then ask you to open Quick Assist and grant control. That’s the trick: the email flood makes fake help feel timely. They may also push AnyDesk or a PowerShell installer. Malware has followed within fifteen minutes. No ticket? External sender? Before sharing anything, call your helpdesk using the number you already know.
Attackers are using Microsoft Teams external chat to pose as internal IT support staff, often after overwhelming employees with email subscription messages. They persuade victims to join a voice call, approve remote-control tools, or run commands, with some incidents ending in malware infections…
Attackers are posing as internal IT support staff in Microsoft Teams, often after flooding an employee’s inbox with subscription emails to create urgency. They persuade victims to grant remote access through legitimate support tools, then install malware, steal information, and in some cases deploy…
Attackers overwhelm employees with hundreds of spam messages, then contact them through Microsoft Teams while posing as internal IT support. They offer to fix the inbox problem, move victims into a voice call, and persuade them to install or use remote-access tools such as Quick Assist. The scams…
Researchers observed a coordinated social-engineering operation (“Spring Ring”) where attackers used external Microsoft Teams accounts to pose as internal IT help desk staff and start voice calls. Victims were pressured to install remote-control tools (like Quick Assist or other RMM software) or…
AhnLab reports Larva-24009 has continued phishing campaigns through 2026, sending emails that trick employees into opening fake “document” attachments that are actually shortcut (LNK) files. When opened, the attachment runs hidden PowerShell commands, shows a decoy document, and silently downloads…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
