Microsoft investigated two real intrusions in which attackers impersonated IT support staff through Microsoft Teams messages and calls. They persuaded users to open Quick Assist and share a connection code, then used the remote session to pursue high-impact access to privileged accounts and domain systems. The incidents show that an unexpected support request in Teams can become a serious identity and data-loss event.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
“IT support” calls you on Teams. You never asked for help. They say, “Open Quick Assist and give me the connection code.” Once connected, they can control your computer and run files from Downloads. That’s the trap: the code isn’t a support ticket. It hands over your screen. In these cases, that opening led to privileged account access and data theft. Unexpected Teams support request? Don’t share the code. Contact your IT service desk yourself.
Attackers used external Microsoft Teams chats to impersonate internal IT support and convince employees to grant remote access to their Windows computers. In many cases, they first flooded inboxes with subscriptions or confirmation emails, then offered fake assistance and persuaded victims to use…
Attackers are using Microsoft Teams external chat to pose as internal IT support staff, often after overwhelming employees with email subscription messages. They persuade victims to join a voice call, approve remote-control tools, or run commands, with some incidents ending in malware infections…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
Attackers posed as internal IT or help-desk staff in Microsoft Teams, then persuaded employees to open Quick Assist and share its connection code. That remote access let the attackers abuse insecure certificate settings, gain privileged access, and in one case copy company data to an external…
UK, US, and Dutch authorities reported Iranian state-linked cyber actors using social messaging apps like Telegram and WhatsApp to build trust with dissidents, activists, and journalists. The actors then convince targets to open “legitimate-looking” files (fake apps or documents like MRI results)…
A financially motivated group called Breeze Comet targeted Brazilian financial and retail organizations by impersonating IT support and convincing staff to install remote-access tools. After gaining access, the attackers moved into internal payment systems (like Pix/STR/Boleto) and executed…
