Attackers overwhelm employees with hundreds of spam messages, then contact them through Microsoft Teams while posing as internal IT support. They offer to fix the inbox problem, move victims into a voice call, and persuade them to install or use remote-access tools such as Quick Assist. The scams can lead to credential theft, data theft, and ransomware in less than 15 minutes.
This campaign begins with a nuisance that looks harmless: an employee's inbox suddenly fills with hundreds of newsletter and subscription confirmation emails. Minutes later, a Teams message arrives from someone posing as internal IT support, offering to fix the very problem the attackers just created. The fake help desk identity often uses names like "helpdeskteam365" or "itcoreportal," adds "(Internal)" to the display name, and sometimes includes the victim company's own name or domain to build false trust.
Once the victim responds, the conversation typically shifts to a Teams voice call. The attacker asks the victim to use Quick Assist, since it ships with Windows and only requires reading back a six-digit code, or to install commercial remote-access tools such as AnyDesk or ScreenConnect. Arctic Wolf has documented more than 400 incidents involving this abuse of Microsoft Teams external chat.
The pretext works because it solves a problem the target is already experiencing. A flooded inbox is a real, visible annoyance, and an apparent IT contact offering a quick fix feels like a welcome relief rather than a threat. The display name tricks compound this: Teams marks the sender as external, but the "(Internal)" label and company-specific naming convince many users to overlook that signal. Attackers also avoid posting malicious links directly in chat, instead waiting until the remote session is underway to download files to the device, which helps the interaction look legitimate throughout.
Organizations should treat unsolicited Teams messages from IT as unverified by default, especially when marked external, and route employees back to a known internal support channel rather than letting them engage directly. No legitimate help desk interaction should require handing over a Quick Assist code or installing remote-access software on demand. Because engagement can lead to compromise in under 15 minutes, with credential theft alerts sometimes firing at the same time as the first suspicious chat, rapid reporting of unexpected Teams contact is essential. Security teams should also monitor for the installation of remote-access tools following external Teams conversations, since these tools have been used as a second foothold that persists even after an initial access method is removed.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers first flood an employee's inbox with hundreds of newsletter and subscription confirmations, then contact the employee on Microsoft Teams posing as internal IT support offering to fix the problem they created.
Attackers commonly move the conversation to a Teams voice call and ask victims to use Quick Assist, which comes built into Windows, or to install AnyDesk or ScreenConnect.
Watch for Teams messages from accounts marked external despite display names including "(Internal)," IT contact arriving right after a sudden spam flood, and requests for a Quick Assist code or remote-access software installation.
Once a victim engages and grants remote access, it can take less than 15 minutes for malicious code to start running, and some organizations have seen credential theft alerts fire at the same time as the first Teams chat alert.
Hundreds of subscription emails hit your inbox. Then IT messages you. The Teams message says, ‘IT Service Desk (Matthew) (Internal): I can help fix the spam problem.’ But Teams marks the sender external. They created the problem they’re offering to fix. Next comes a Teams voice call: ‘Read me your six-digit Quick Assist code.’ They may ask for AnyDesk or ScreenConnect instead. No malicious link needed, they want remote control. Spam flood, then external ‘IT’? Contact your real help desk through your usual internal channel.
Attackers are using Microsoft Teams external chat to pose as internal IT support staff, often after overwhelming employees with email subscription messages. They persuade victims to join a voice call, approve remote-control tools, or run commands, with some incidents ending in malware infections…
Attackers used external Microsoft Teams chats to impersonate internal IT support and convince employees to grant remote access to their Windows computers. In many cases, they first flooded inboxes with subscriptions or confirmation emails, then offered fake assistance and persuaded victims to use…
Attackers are posing as internal IT support staff in Microsoft Teams, often after flooding an employee’s inbox with subscription emails to create urgency. They persuade victims to grant remote access through legitimate support tools, then install malware, steal information, and in some cases deploy…
Microsoft is adding AI-based phishing detection to Teams after attackers repeatedly used external chats to impersonate support staff, send malicious files, and deliver fake billing notices. The reported attacks exploit Teams' default external-access feature rather than a software flaw, making…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
Microsoft reports a real campaign where attackers contact employees through Microsoft Teams while pretending to be IT/helpdesk and persuade them to grant remote control (for example via Teams “request control” or Quick Assist). Once they get an interactive session, the attacker silently installs…
