Arctic Wolf counts 400-plus fake IT help desk intrusions over Teams external chat
Arctic Wolf Labs said on October 26 it analyzed more than 400 incidents where attackers flooded an inbox with spam, then messaged the employee on Microsoft Teams as IT support and talked them into Quick Assist. Some reached code execution within 15 minutes.
Arctic Wolf Labs published an analysis on October 26 of more than 400 incidents in which attackers abused Microsoft Teams external chat for initial access. The pattern starts with an inbox flood of newsletter and subscription confirmations; minutes later the attacker messages the employee on Teams posing as IT support. Teams external access is open by default, and 30 to 40 percent of cases came from free onmicrosoft.com tenants, with display names like "IT Service Desk (Matthew)" or an "(Internal)" suffix. Recent cases shifted to paid domains, about half of them .top. Quick Assist was the most common tool, with the victim reading back a six-digit code, followed by AnyDesk, ScreenConnect and TeamViewer. Attackers often contacted several users within about five minutes, and some reached payload execution in under 15 minutes. Microsoft first described the technique in 2024, linked to Black Basta.
Why it matters
This is help desk social engineering run in reverse: the attacker plays the help desk, and the employee grants the session. No credential is stolen, MFA is never challenged, and the remote session runs as the user on a trusted device, so identity telemetry shows nothing unusual.
Move Teams external access from "allow all" to an allow-list of partner domains, and block unmanaged Teams accounts and trial tenants. Restrict Quick Assist to IT roles or remove it, and block unsanctioned RMM tools. Publish how your real IT team contacts staff and require an out-of-band callback to a registered number before anyone grants remote access. Alert on the Teams ChatCreated event from external tenants and correlate it with remote-tool launches.
Source: Arctic Wolf
Related on Start with Identity
- BlogMicrosoft: fake Teams help desk calls led to AD CS certificates for privileged accounts and a domain controller
Microsoft investigated two intrusions that began with attackers posing as IT support on Teams and ended with Active Directory Certificate Services abuse. ESC1 y
- BlogBinance says a fake job interview and an internal AI tool led attackers to its wallet signing service
Binance's initial findings trace the $6.34 billion theft to a September fake recruiter whose coding assignment infected an engineer's Mac. An internal AI tool l
- BlogDevice code phishing industrialises: 25 kits, and Microsoft counts new campaigns daily
The OAuth device authorization flow built for smart TVs is now a phishing-as-a-service product line. Microsoft reported 10 to 15 new campaigns every 24 hours by
- ReportIdentity Breach Report 2026: how attackers get in
123 identity breaches, 2021 to 2026: MFA was bypassed in 25 of the 41 with a known MFA status, and 44% of 2025-2026 cases had no login for MFA to protect.
- BreachScattered Spider and the help desk: social engineering the identity reset
Scattered Spider showed that the fastest way past strong authentication is often a phone call to the help desk. Here is the pattern and how to close it.
- CVECheck Point Remote Access VPN lets attackers in without a password over IKEv1
A certificate validation logic flaw in Check Point Remote Access and Mobile Access over deprecated IKEv1 let attackers open a VPN session without a valid passwo