Identity · 228 days ago
Threat actors impersonated internal IT over Microsoft Teams and convinced users to start Quick Assist remote sessions. Once connected they harvested credentials via spoofed web forms and deployed MSI packages that sideloaded malicious DLLs to establish command-and-control and persistent access. The campaign exploits permissive Teams external messaging and user trust in collaboration tools.
2 sources covering this story
Help on the line: How a Microsoft Teams support call led to compromise | Microsoft Security Blog
Read the new Microsoft Cyberattack Series report to learn more about on how deception and trusted tools can enable identity-led intrusions.
Rapid7 Guidance on Observed Microsoft Teams Phishing Campaigns
The Rapid7 MDR team is currently monitoring an increase in phishing campaigns where threat actors (TAs) impersonate internal IT departments via Microsoft Teams.
Part of the PlainSec briefing for 2026-03-17