Teams Helpdesk Impersonation

Attack type	Social engineering, remote access
Threat actors	The operator in Microsoft's September 2026 report, Storm-1811 (Black Basta ransomware), and any actor messaging staff from an outside Microsoft 365 tenant
Coverage since	October 23, 2026
Platforms	Microsoft Teams, Microsoft 365, Windows devices onboarded to Microsoft Purview, plus your EDR for the endpoint stage

"Hi, this is IT. We're rolling out a security update — can I take a look at your screen?" The Teams call comes seconds after the chat, and one yes hands the attacker a domain-joined computer.

The threat

Microsoft Teams lets people in other organizations chat with your staff by default. Attackers use that. They set up a Microsoft 365 tenant of their own, which takes minutes and comes with an onmicrosoft.com domain, and message employees as IT, the help desk or a colleague. The lure is routine: "Microsoft Security Update", "Spam Filter Update", "Account Verification". Some attacks set it up first by flooding the user's mailbox with subscription emails, so the offer of help is welcome.

A Teams call follows within seconds. On the call, the attacker gets the user to approve a Quick Assist session, share their screen, open a fake IT page, or download and run an installer. The installer often comes from cloud hosting anyone can set up in minutes, such as an Azure virtual machine's default cloudapp.azure.com address.

In the intrusion Microsoft Threat Intelligence reported on September 2, 2026, the operator then:

1. installed an update-themed MSI silently from attacker-controlled cloud storage;
2. ran a portable Node.js runtime and an encrypted JavaScript implant, kept running at every sign-in through an EdgeUpdate entry;
3. took screenshots, mapped the domain and probed servers for reachability;
4. moved over WinRM to dozens of systems: file, database and application servers, domain controllers and certificate authorities.

Microsoft describes this as activity that can precede ransomware or data theft. Storm-1811, a Black Basta ransomware actor, has used the same Teams help desk lure since 2024.

Why it gets past defenses

• The lure never touches email. The chat and the call happen in Teams, outside the email gateway's view.
• There is no time to think. The call comes seconds after the chat, before the user has looked at who is asking.
• A new tenant for every wave. A tenant takes minutes to create, so blocking one after it is seen does not stop the next.
• The names can look ordinary. An attacker can use an ordinary personal name, or a real colleague's name on a tenant named after your company, instead of "Help Desk". The name shown on the call can differ from the account name. Filters that look for suspicious display names miss them.
• The user lets the attacker in. Quick Assist is a built-in Windows tool, screen sharing is a Teams feature, and the user approves both. Nothing is exploited.
• The tools are legitimate, and the malware is new. PowerShell, msiexec, an official Node.js build, rundll32 and WinRM are on every corporate network. The installers are rebuilt often, so published file hashes go out of date and antivirus may not recognize the latest one.
• The sign-ins look normal. The attacker works through the employee's own computer during the call, so there is no strange sign-in to flag.

How Fluency catches it

Fluency alerts on the first contact and on the download, and puts the endpoint alerts that follow next to them.

1. The first chat. When a user of a *.onmicrosoft.com tenant starts a Teams chat with anyone in your organization, Fluency raises a high-confidence alert. The sender's name does not matter, and lookalike tenants named after your own company are caught too. Your own guests, partners on their own domains, personal Teams accounts and chats your users start do not raise it.
2. One case per attacker account. The chat alert is keyed on the attacker's account. An account that messages several employees becomes one prioritized case, and its alerts name everyone it contacted, so you know exactly who to call.
3. The installer. When a browser on a managed Windows device downloads an installer, executable, script or archive from a *.cloudapp.azure.com host, Fluency raises a high-confidence alert on the employee. Software vendors do not ship installers from these addresses. The alert names the file, its hash, the host it came from and the device, so you can block the file and the host in your EDR.
4. The hands-on-keyboard stage. If you collect alerts from Microsoft Defender XDR, CrowdStrike Falcon or SentinelOne, each one becomes a Fluency behavior on the user and device it names. That includes Defender's detections for this campaign's implant, Active Directory enumeration and WinRM lateral movement, and its mail-bombing and Teams-impersonation alerts. AI Assist triages every one, so none of them waits unread in a queue.

Detections included

Detection	What it catches
O365_Teams_OnMicrosoft_Tenant_Chat	A Teams chat started with your users by someone on a *.onmicrosoft.com tenant outside your organization. High confidence.
O365_Endpoint_Download_From_Azure_CloudApp	A browser download of an installer, executable, script or archive from a *.cloudapp.azure.com host. High confidence.
EDR alerts	Microsoft Defender XDR, CrowdStrike Falcon and SentinelOne alerts, scored as behaviors on the user and device they name.

MITRE ATT&CK

Tactic	Technique
Initial Access	T1566.003 Spearphishing via Service (the Teams chat)
Defense Evasion	T1656 Impersonation (posing as IT support or a colleague)
Execution	T1204.002 User Execution: Malicious File (the installer)
Command and Control	T1219 Remote Access Software (Quick Assist), through your EDR's alerts
Lateral Movement	T1021.006 Windows Remote Management, through your EDR's alerts

Get this coverage

Both detections are on every Fluency instance, and both read the Microsoft 365 audit log, collected through the Office365 Audit API or Office 365 Audit.

• The chat detection uses the Teams records in that log. Microsoft typically delivers chat records 60 to 90 minutes after the chat, and call records hours later, so Fluency alerts on the chat. It is the fastest way to find out who was contacted and contain the attack.
• The download detection needs Windows devices onboarded to Microsoft Purview, which records browser downloads in the same log. Devices already onboarded to Defender for Endpoint are in Purview's device list.
• For the endpoint stage, connect your EDR.

The best defense pairs detection with prevention:

• Set Teams external access to Allow only specific external domains and list the partners you work with.
• Turn off chat with unmanaged (personal) Teams accounts, the next place an attacker can come from.
• Remove Quick Assist where IT support does not use it.
• Tell staff that IT will never contact them from an outside Teams account, and that a sudden flood of spam is a common setup for a fake help desk call.

Fluency watches for the attempts that still get through.

Not a customer yet? Start a free trial or book a demo.

Related

• Storm-2372: device-code phishing — another lure that can start on Teams, aimed at the user's tokens instead of their computer.
• Teams Helpdesk Impersonation Detections — the release notes, with each rule's full match conditions, what it does not cover, and a prioritized triage checklist.