Microsoft Teams IT Support Scams: Malware Risks

Microsoft Teams IT support scams use social engineering to impersonate IT staff, gain remote access to employee devices, and potentially deliver malware or ransomware. Arctic Wolf Labs has reported a recurring pattern involving external Teams chats, convincing support identities, and remote-access tools.

These attacks exploit trust rather than relying only on software vulnerabilities. Email bombing, fake IT support messages, and pressure to resolve an urgent problem can lead employees to authorize access that attackers then abuse.

Organizations can reduce the risk by reviewing external communication settings, verifying support identities, controlling remote-access software, and monitoring endpoint and identity activity.

Attackers create or acquire Microsoft 365 tenants and use display names such as Help Desk, IT Support, or Enterprise IT & Security. Some identities use onmicrosoft.com domains, while others use paid domains intended to appear credible.

The attack may begin with email bombing, in which a victim receives a large number of newsletter or subscription confirmation messages in a short period. This sudden flood can create confusion and urgency.

A person claiming to be from IT support then contacts the victim through an external Microsoft Teams chat and offers assistance. The attacker may also use voice-based social engineering, known as vishing, to persuade the employee to grant remote access.

The apparent support interaction can therefore become an initial access route into the victim's computer or corporate environment.

Once an employee grants access, attackers may abuse legitimate remote monitoring and management tools. Tools reported in these campaigns include Quick Assist, AnyDesk, TeamViewer, ScreenConnect, and Zoho Assist.

Remote access can allow an attacker to inspect the system, run commands, download files, and attempt to establish further access. In some cases, attackers may persuade victims to run PowerShell commands or execute an installer.

Arctic Wolf described a case involving an MSI installer hosted on Microsoft Azure Blob Storage. According to the report, the installer launched a PowerShell script that extracted and executed a Python implant.

The reported implant then initiated another MSI transaction and queried Active Directory for computer and user objects before transmitting collected information to an external server.

Depending on the environment and the attacker's access, subsequent activity may include reconnaissance, lateral movement, data exfiltration, additional remote-access deployment, and ransomware execution.

These attacks abuse trusted communication platforms and legitimate remote-access software. As a result, suspicious activity can initially resemble ordinary technical support.

Attackers may avoid placing a malicious URL directly in a Teams message and instead navigate to a payload during the remote session. This can reduce the effectiveness of defenses that rely primarily on scanning message links.

Organizations should therefore monitor more than incoming messages. Endpoint telemetry, identity sign-in records, remote-access sessions, PowerShell activity, installer execution, and unusual Active Directory queries can all provide important investigative signals.

Email security remains useful, but it should be combined with endpoint detection, identity monitoring, and controls over remote-access applications.

Restrict external access: Review Microsoft Teams external communication settings and allow only the external interactions required for business operations.

Verify support identities: Train employees to confirm unexpected IT requests through a separate, trusted communication channel rather than relying on the sender's display name.

Control remote-access tools: Approve authorized tools, restrict unauthorized installations where practical, and monitor unexpected remote sessions.

Monitor suspicious execution: Investigate unusual PowerShell commands, MSI installations, unexpected Python processes, and suspicious child-process activity.

Strengthen identity security: Enforce multifactor authentication, review privileged access, and investigate unusual sign-ins or unexpected permission changes.

Prepare for ransomware: Maintain protected backups, segment critical systems, and regularly test incident response and recovery procedures.

Train employees: Explain how email bombing, impersonation, and urgency can be used to manipulate staff into granting access.

Microsoft Teams IT support scams demonstrate how attackers can combine email bombing, impersonation, remote-access software, and malware delivery to compromise organizations.

The central risk is not simply the Teams message itself. It is the chain of trust that persuades an employee to provide access and enables an attacker to perform additional actions.

Organizations should combine external communication controls, identity protection, endpoint monitoring, approved remote-access tools, employee awareness, and tested incident response plans.

At AESPARROW, we recommend a proactive security approach that helps organizations identify weaknesses, monitor suspicious behavior, and improve their readiness to respond to malware and ransomware threats.