Fake IT Support in Microsoft Teams: How Businesses Can Stop Remote-Access Attacks

An employee receives an unexpected Microsoft Teams call from someone claiming to be with IT support. The caller says the employee’s Microsoft 365 account requires an urgent security update and asks to share the screen, approve control, or open Microsoft Quick Assist. Within minutes, the caller controls the employee’s computer.

Microsoft Threat Intelligence is tracking a human-operated intrusion campaign that follows this pattern. Attackers abuse Microsoft Teams external collaboration to impersonate IT or helpdesk personnel and persuade employees to approve legitimate remote-support sessions.

How the attack begins

The attacker contacts an employee from an external Microsoft Teams account while pretending to represent the company’s internal IT department, Microsoft, or its managed IT provider. The reason may sound routine:

• A Microsoft security or spam-filter update
• Account verification or a password problem
• A computer-performance or antivirus issue
• Required maintenance or a threat of account deactivation

Teams displays indicators when a person is contacting an employee from outside the organization. The attack succeeds when the caller convinces the employee that the warnings are normal and that the session is urgent. A voice call can add pressure while keeping the instructions out of written chat logs.

What happens after remote access is approved?

Microsoft observed attackers using legitimate remote-support methods, including Quick Assist and interactive screen-sharing controls. After gaining control, the attacker used PowerShell to download and silently install a malicious Windows Installer package disguised with an innocent name such as “Hotfix” or “devfix.”

The attack then used a legitimate portable Node.js runtime to execute an obfuscated JavaScript implant. Because PowerShell, Windows Installer, Node.js, remote-support software, and Windows Remote Management all have legitimate uses, the activity may initially resemble normal administration.

Microsoft observed the attackers using compromised computers to:

• Identify installed security software and collect device information
• Enumerate user, domain, application, file, and database systems
• Capture screenshots and establish persistent access
• Execute additional commands and payloads
• Attempt connections to domain controllers and certificate authorities
• Move across the network through Windows Remote Management

This activity can lead to credential theft, confidential-data exposure, extortion, or widespread ransomware deployment.

Why small and midsize businesses are vulnerable

Small businesses routinely depend on remote support. Employees are accustomed to hearing “share your screen,” “approve my request,” or “open Quick Assist.” Attackers exploit that familiarity.

The risk is highest when employees do not know which company provides IT support, how legitimate requests begin, which remote tools are authorized, how a technician verifies identity, or whom to call when uncertain. A receptionist, bookkeeper, office manager, or remote employee may believe that cooperating quickly is helpful.

Medical practices, insurance agencies, law firms, construction and property-management businesses, restaurants, nonprofits, local governments, and other organizations using outsourced IT should pay particular attention. One employee computer may expose email, customer records, accounting systems, SharePoint, OneDrive, business applications, or network credentials.

Warning signs employees should recognize

• An unfamiliar person claims to be IT support.
• The Teams contact is marked as external.
• The employee did not request assistance.
• The caller creates urgency or threatens account deactivation.
• The caller asks the employee to ignore an external-user warning.
• Quick Assist, a support code, computer control, or administrator access is requested unexpectedly.
• The caller asks the employee to run PowerShell or Command Prompt.
• Software is installed without a normal support ticket.
• The caller discourages contact with management or the regular IT provider.

Professional language and technical knowledge do not prove that a caller is legitimate.

The most important control: verify support independently

Every organization should establish a clear rule: employees must independently verify unexpected IT-support requests before granting remote access. Verification should happen through a trusted channel—not contact information supplied by the person making the request.

1. Report the issue through the approved support channel.
2. Create and confirm a matching ticket number.
3. Verify the technician through a known telephone number or company procedure.
4. Grant remote access only after verification.
5. Confirm what actions the technician expects to perform.
6. Document and terminate the session when the work is complete.

Microsoft Teams settings businesses should review

Microsoft allows administrators to control who can communicate with employees through Teams external access. Administrators can allow only trusted external domains, block selected or all external domains, limit external communication to particular employees, disable unsolicited contact from unmanaged Teams accounts, and review collaboration policies.

Blocking all outside communication may be inappropriate for organizations that work with customers, vendors, or partners. The correct configuration should reflect job roles and actual business needs.

Remote-support tools also require governance

Businesses should maintain an approved list of remote-support products and define who may initiate a session, whether an employee must first create a ticket, how sessions are logged, whether unattended access is permitted, who has administrative rights, and how former vendors are removed.

Security teams should investigate unexpected Quick Assist use or unfamiliar remote-management software—especially when followed by PowerShell, Command Prompt, Windows Installer, scripting, or unusual network activity.

Additional Microsoft security controls

Conditional Access

Microsoft Entra Conditional Access can require MFA, managed or compliant devices, approved locations, or additional identity checks. Phishing-resistant authentication provides stronger protection than passwords or easily intercepted verification methods.

Endpoint detection and response

Endpoint protection should look for activity after a remote session begins, including PowerShell downloads, silent installers, Node.js in unusual directories, WScript activity, persistence changes, screen capture, Active Directory reconnaissance, WinRM movement, or disabled security controls.

Least privilege and segmentation

Employees should not routinely have local-administrator rights. Workstations should not have unrestricted administrative paths to servers, backups, domain controllers, or critical infrastructure. These controls do not eliminate the attack, but they can reduce its impact.

How AI can help defenders

AI-assisted security tools can correlate an external Teams contact with a remote session, suspicious scripts, software installation, identity alerts, and network movement. They can summarize alerts, find similar activity on other computers, prioritize incidents involving administrators or finance employees, and build an investigation timeline.

Human review remains mandatory when verifying a technician, approving remote access, isolating a device, disabling an account, determining whether data was accessed, resetting credentials, restoring systems, or notifying insurers, legal counsel, customers, or regulators. AI can identify patterns, but it does not know every legitimate vendor relationship or operational exception.

What to do if an employee approved a suspicious session

1. Stop using the affected computer and disconnect it from the network without erasing it.
2. Contact the legitimate IT or cybersecurity provider through a known channel.
3. Preserve Teams messages, caller details, meeting information, and support codes.
4. Identify the remote-access tool and review processes, applications, startup items, tasks, and persistence.
5. Check for PowerShell, MSI, Node.js, WScript, Command Prompt, or WinRM activity.
6. Revoke active Microsoft 365 sessions and reset exposed credentials from a known-clean device when appropriate.
7. Review MFA methods, account changes, administrative activity, and related systems.
8. Search other computers and determine whether servers or identity systems were reached.
9. Review endpoint, Microsoft 365, firewall, and authentication logs.
10. Notify the cyber-insurance carrier according to the policy and preserve evidence before reimaging.

Simply closing Quick Assist or restarting the computer may not remove software or persistence installed during the session.

Five questions every business should ask

Frequently asked questions

Sources

• Microsoft Security Research: Impersonating IT support through Microsoft Teams
• Microsoft Security: Security fundamentals that materially reduce risk
• Microsoft Learn: Manage Teams external meetings and chat
• Microsoft Learn: Teams security best practices for safer messaging
• Microsoft Learn: Microsoft Entra Conditional Access
• CISA: Teach employees to avoid phishing