Victims in China reported losing thousands to hundreds of thousands of dollars after scammers convinced them to move conversations onto Microsoft Teams using login credentials the scammers provided. Common setups included romance and “investment” pitches (including crypto) and official-sounding law enforcement pretexts, with scammers leveraging Teams accounts they controlled to later cut off access and erase chat history.
Scammers typically make first contact on popular social or professional platforms, then steer the conversation toward moving to Microsoft Teams or a similar workplace app. Rather than letting the victim set up their own account, the scammer creates a Teams login and hands it over, using enterprise features to keep control of the environment. Once the victim is inside that scammer-controlled space, the attacker can later deactivate the account or erase the chat history, cutting off any evidence of the conversation.
Three pretexts show up in the reporting: a fake recruiter asking a job seeker to move communication to Teams for 'work' reasons, a romantic interest who frames Teams as a private 'secret base' before introducing a cryptocurrency investment pitch, and a caller posing as law enforcement investigating a joint case with US Customs and Border Protection who pushes the target to install Webex for a video call.
The core trust lever is brand recognition. Because Teams is made by a well known, trusted technology company, victims assumed the app itself vouched for the person using it. One victim explained she trusted the setup simply because Microsoft developed it. Scammers reinforced this by offering plausible cover stories, such as claiming a victim's device only allowed certain approved apps, to explain why communication had to move off familiar channels like WeChat.
The romance and investment variation succeeded by combining emotional investment with financial urgency: once trust was established privately on Teams, the promise of returns 'much faster than trading stocks' pushed victims to commit more money, in at least one case through bank loans.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Scammers use Teams because it is a legitimate workplace app from a trusted multinational tech company, which lowers victims' guard, and because they can create the account themselves and control access to it, including the ability to erase chat history later.
Being told to log in using credentials that someone else created for you is a major warning sign. Legitimate contacts do not need you to use an account they set up on your behalf.
A relationship builds on a platform, then moves to Teams as a private 'secret base,' after which the scammer introduces a cryptocurrency investment opportunity promising fast profits, sometimes encouraging victims to take out loans to invest more.
Do not follow their instructions or install any app they suggest. Verify the claim independently through official channels you look up yourself before taking any further action.
You meet a “recruiter” on LinkedIn, and they say, “Let’s move to Microsoft Teams, I’ll send you a login.” That’s the scam. These scammers create a Microsoft Teams account for you, send you the username and password, then move the chat there to pitch “investment projects” or even fake law enforcement calls. One victim was told Teams was their “secret base together” by a ‘Microsoft researcher’ boyfriend, then pushed into a crypto scheme and lost over $100,000. Because the scammer owned the account, they could erase the chat and vanish. Your move: if anyone, recruiter, romantic interest, or “police”, gives you a ready-made Teams or Webex login, stop. Don’t sign in. Use only accounts you created yourself.
This news roundup describes real social-engineering operations where attackers impersonate trusted support teams to trick people into giving up secrets. One campaign uses email/SMS/WhatsApp plus AI voice calls pretending to be Apple Support to steal iPhone passcodes, while another uses phishing…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
Cisco Talos reported a real-world SMS phishing campaign using a framework called “JWR” that impersonates toll agencies and postal/courier services to lure victims to fake payment and login pages. Unlike basic phishing pages, the operator can actively steer the victim through fake checkout/login…
Researchers say a phishing-as-a-service platform called AnonyMousKIT targets people who recently lost or had an iPhone stolen by pretending to be “Apple Support.” The operation uses email/SMS/WhatsApp and AI-assisted voice calls to convince victims to share their iPhone passcode and follow a…
Google tracked three suspected Russia-linked groups running targeted phishing that abuses real login and authentication features (app passwords, OAuth, and device codes) to get into accounts. The lures often look like legitimate conference or diplomatic invitations, and some campaigns spoof…
This threat trend report describes multiple real-world APT campaigns where attackers rely on social engineering and trusted services (Zoom/Teams, Telegram, webmail, GitHub) to steal credentials and access cloud accounts. Notable examples include fake meeting lures to deliver malware, and abuse of…
