Fake 'IT support' contacts on Microsoft Teams follow spam floods, Arctic Wolf finds
Help Net Security reported on 27 October 2026 that Arctic Wolf has documented more than 400 incidents in which attackers flooded employees' inboxes with spam and then contacted them through Microsoft Teams external ch…
- First reported
- Reports
- 1
Source: helpnetsecurity.com · published
What happened
Help Net Security reported on 27 October 2026 that Arctic Wolf has documented more than 400 incidents in which attackers flooded employees' inboxes with spam and then contacted them through Microsoft Teams external chat, posing as IT support offering to fix the problem. In many cases the fake help-desk message arrived minutes after hundreds of newsletter and subscription confirmations filled the victim's inbox. According to the report, between 30 and 40 percent of cases used free onmicrosoft.com tenants given IT-sounding names such as "helpdeskteam365" and "itcoreportal", with display names like "IT Service Desk (Matthew)" or names with "(Internal)" added. More recently attackers shifted to paid domains, about half using the .top TLD. Arctic Wolf says this does not exploit any Teams vulnerability.
How the scam works
The attack combines pressure and a ready-made solution. A flood of spam makes an employee anxious; moments later a "technician" appears in Teams offering help. Employees are trained to distrust email, but a message inside the company's own Teams environment tends to get around that caution. Teams external access (federation) is on by default, so any user in another Microsoft 365 tenant can chat with and call staff if both tenants allow it.
Once a target replies, the fake technician often moves to a Teams voice call and asks the victim to install remote access software. Quick Assist is the most common choice because it comes with Windows and the victim only has to read back a six-digit code. AnyDesk and ScreenConnect also appear. Arctic Wolf says malicious code can start running within 15 minutes, and attackers often target several users within about five minutes, probably through automation. The intruders avoid posting links in Teams, where they would be scanned, and download files during the remote session. In one case a PowerShell command led to a Python implant that listed Active Directory accounts; some intrusions ended in data theft and ransomware.
Arctic Wolf recommends allowing external chats only with specific partner domains, blocking unmanaged Teams accounts and trial tenants, and limiting Quick Assist and similar tools to authorised IT staff.
Source
Help Net Security, "Hackers bury inboxes in spam then show up on Microsoft Teams posing as IT support" (27 October 2026), reporting Arctic Wolf research.
Red flags
- A sudden flood of newsletter or subscription emails, followed by an unsolicited contact from 'IT'.
- A Teams chat from an external account with a name like 'IT Service Desk' or '(Internal)' added.
- A request to move to a voice call and install Quick Assist, AnyDesk or ScreenConnect.
- A request to read back a code from your screen.
- An 'IT' contact you did not request, at an unusual time.
If you were targeted
- 1Don't accept external Teams chats from unknown 'IT support', and never install remote access tools at a stranger's request.
- 2Check with your real IT help desk using a number or portal you already know.
- 3If you gave access, disconnect from the network, tell your security team immediately and change passwords from a clean device.
- 4Organisations should restrict external Teams access to approved partner domains and block unmanaged accounts.
- 5Limit Quick Assist and similar tools to authorised IT staff.