Fake IT support on Microsoft Teams: the flooded inbox, then the ‘help desk’ call
In the morning, an employee’s inbox fills up with hundreds of subscription emails. Shortly after, a Teams message arrives: “IT Support (Internal)” offers to fix the problem. She accepts a screen-sharing session. Less than 15 minutes later, malware is running on her computer.
That’s the scenario Arctic Wolf described on October 26, after analyzing more than 400 incidents of this kind. This fake IT support scam doesn’t only target large companies: it targets any organization that uses Microsoft Teams with the default settings.
Why the scam works
No Teams vulnerability is involved. Attackers use a normal feature: external access, which lets any Microsoft 365 organization message your employees. According to Arctic Wolf, this feature is on by default.
- 30 to 40% of cases used a free *.onmicrosoft.com Microsoft 365 account, set up in minutes.
- Among purchased domains, about half ended in .top.
- Display names mimic internal support: “IT Support (Internal)”, a friendly first name, a French version such as “Supporte TI”, emoji and, more recently, the targeted company’s own name.
The technique isn’t new: Microsoft documented it back in 2024 with the group linked to the Black Basta ransomware. It has simply become routine.
The sequence reported by Arctic Wolf
T+0
The inbox is flooded with hundreds of subscription emails.
A few minutes
An external “IT Support” messages or calls on Teams to “fix the spam”.
Next
They ask for screen sharing, often the six-digit Quick Assist code.
Under 15 min
Malware is launched on the computer.
Arctic Wolf also notes that attackers often contact several employees at the same company within about five minutes.
How to spot fake IT support
Here’s what the conversation looks like. Each number is a signal an employee can learn to see.
The red flags (fictional example)
- 1The External tag: the message comes from another organization, even if the display name says “Internal”.
- 2They know about your spam problem. Of course: they caused it.
- 3They ask for a remote-access code in a chat you didn’t start.
- 4No link to click: according to Arctic Wolf, attackers avoid link filters this way and open the booby-trapped page themselves once connected.
Once connected, Arctic Wolf most often saw Windows Quick Assist, followed by tools such as AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport or LogMeIn installed to keep access. In one case, a PowerShell command downloaded an installer that then listed the network’s users and computers and sent them to the attacker. Our decision tree for abused remote-access tools helps you clean up those tools.
The Teams settings to change
These changes are quick for your IT lead or provider, and they close the most-used door.
What every employee needs to know
Tell your team clearly how real IT support contacts them: through which channel, under which name, at which number. Then one rule is enough: you call back yourself. Teams also has a button to report a suspicious message; show it to them.
The callback rule, to post near every desk
🗣️ What to say
“Thanks, I’ll call you back at the IT number I already know.”
“I need to check with our IT lead first.”
⛔ What never to do
- Give a Quick Assist code to someone you didn’t call yourself.
- Install software suggested in a chat.
- Accept screen sharing requested by a stranger.
- Trust a display name: only the External tag counts.
🚨 Someone already said yes? In this order:
- Disconnect the computer from the network (cable and Wi-Fi), without shutting it down.
- Call your real IT lead or provider.
- Change the password from another device and sign out all open sessions: our article on Microsoft 365 session theft explains why the password alone isn’t enough.
- Look for recently installed remote-access software.
- Report the chat in Teams and note the sender’s display name and domain.
This scam belongs to a family of attacks that rely on trust rather than a flaw, like Microsoft 365 device code phishing. Our cybersecurity services review your Teams and Microsoft 365 settings and train your staff, and our automated 24/7 monitoring with the on-call technician stepping in flags newly installed remote-access tools and unusual sign-ins on monitored computers.
Book your free cyber check
Does your Teams accept messages from any organization? The free cyber check reviews your external access settings, the remote-access tools installed and what your staff know about these scams.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Our office: 2572 boul. Daniel-Johnson, office 237, Laval.
Sources
- Arctic Wolf, Shubham Dubey, “Threat Actors Abuse Microsoft Teams External Chat for Initial Access” (October 26, 2026)
- Help Net Security (October 27, 2026)
- Dark Reading, “Email bombing and external Teams chats”
Photo: Mikhail Nilov, Pexels (Pexels licence).