Advisory: Teams IT-Helpdesk Impersonation Campaign

Attackers posing as IT support are contacting employees on Microsoft Teams from throwaway Microsoft 365 tenants. They call within seconds of opening a chat and talk the employee into a remote-support session, a fake IT page or an installer. This is the campaign Microsoft Threat Intelligence described on September 2, 2026, which turns one remote session into enterprise-wide access.

Any organization that allows Teams chats from outside tenants is exposed, and Teams allows them by default. MSSPs should check every tenant they manage. On October 23, 2026, Fluency released two detections for the campaign to every instance. No action is needed to turn them on.

The playbook

• Throwaway tenants. Each persona sits in a newly created Microsoft 365 tenant on Microsoft's default onmicrosoft.com domain. Some tenants are named to look like the target's own company. A tenant takes minutes to create, so blocking known attacker domains does not keep up.
• A pretext set up beforehand. Some attacks start by flooding the employee's mailbox with subscription-confirmation emails (mail bombing), so an offer from the help desk to fix it is welcome. Others go straight to the Teams chat.
• Chat, then an immediate call. The attacker opens a one-to-one chat as IT, the help desk or a named colleague, and calls within seconds. The name shown on the call can differ from the account name.
• Lures on cloud hosting. On the call, the employee is asked to approve Quick Assist or share their screen, open a link to a fake IT page on cloud storage, or download an installer. The installer can come from a *.cloudapp.azure.com host, the default address of an Azure virtual machine, which anyone can create in minutes.
• A staged loader. The installer's scripts profile the machine before going further. In the intrusion Microsoft reported, the operator then ran a Node.js implant, mapped the domain and moved over WinRM to servers, domain controllers and certificate authorities. The tooling is rebuilt often, so published file hashes go out of date quickly.

Storm-1811, a Black Basta ransomware actor, has used the same lure since 2024.

Why it is hard to catch

• It never touches email. The lure arrives in Teams, outside the email gateway's view.
• Nothing is exploited. The employee approves the session or runs the installer.
• The sign-ins look normal. The attacker works through the employee's own computer during the call, so the employee's sign-in history shows nothing unusual.
• The names look ordinary. Filters based on display names miss attackers who use an ordinary name or a real colleague's name.
• The records arrive late. Microsoft typically delivers Teams audit records 60 to 90 minutes after the event, and call records hours later.

Fluency's new detections

Detection	Fires when	Needs
O365_Teams_OnMicrosoft_Tenant_Chat	A user of an outside *.onmicrosoft.com tenant opens a Teams chat with one of your users, whatever name they use. Guests of your own tenant, partners on their own domains and personal Teams accounts are not matched.	The Microsoft 365 audit log, including Teams (Office365 Audit API or Office 365 Audit)
O365_Endpoint_Download_From_Azure_CloudApp	A browser downloads an installer, executable, script or archive from a *.cloudapp.azure.com host.	Windows devices onboarded to Microsoft Purview, which record browser downloads in the same audit log

Both raise a high-confidence alert. What the installer does after it runs is left to your endpoint protection (EDR). Fluency scores and triages EDR alerts from Microsoft Defender XDR, CrowdStrike Falcon and SentinelOne alongside these.

What we recommend

For every organization

1. Switch Teams external access to an allowlist. In the Teams admin center, under Users → External access, choose Allow only specific external domains and list the partners you work with. The attackers' tenants are created for the campaign, so an allowlist blocks them by default. Also turn off People in my organization can communicate with unmanaged Teams accounts, so the attackers cannot move to personal accounts. Turning external access off entirely also works, but it breaks legitimate partner chats.
2. Tell staff how real IT reaches them. Internal IT never makes first contact from an outside Teams account, and never asks for an unscheduled screen share or installer. A sudden flood of spam is a common setup for a fake help desk call.
3. Turn on the data the detections need. Send the Microsoft 365 audit log, with Teams, to Fluency. Onboard Windows devices to Microsoft Purview so browser downloads are recorded.
4. Treat Defender's Teams-impersonation and mail-bombing alerts as urgent. A clean sign-in history does not clear them.
5. Remove or block Quick Assist if IT support does not use it.

For MSSP partners

• Hunt in every client tenant. Look for Teams chats started by *.onmicrosoft.com users, answered calls from them (Teams CallParticipantDetail records), and open Defender alerts for Teams phishing, mail bombing or hands-on-keyboard activity.
• Check coverage. Confirm which clients send the Microsoft 365 audit log and Purview device data. Clients without them get no coverage from the new detections.
• Act fast when either detection fires. Contact the employee right away. Check whether a call was answered and whether anything was downloaded or installed during it. If anything ran, or a link from the chat was opened, isolate the device, reset the employee's password, revoke their sessions, and review what the account touched on the network.

If you find a match, raise a support ticket and Fluency will help with the investigation. Each rule's full match conditions, what it does not cover, and a prioritized triage checklist are in the Teams Helpdesk Impersonation Detections release notes.

References

• Microsoft Threat Intelligence, Impersonating IT support: how threat actors turn a remote session into enterprise-wide access, September 2, 2026.
• Microsoft Learn, Manage external meetings and chat with people and organizations using Microsoft identities (Teams external access settings).

Splash Summary

Attackers posing as IT support are contacting employees on Microsoft Teams from throwaway Microsoft 365 tenants. They call within seconds of opening a chat and talk the employee into a remote-support session, a fake IT page or an installer. This is the campaign Microsoft Threat Intelligence described on September 2, 2026, which turns one remote session into enterprise-wide access.

Any organization that allows Teams chats from outside tenants is exposed, and Teams allows them by default. On October 23, 2026, Fluency released two detections for the campaign to every instance. No action is needed to turn them on.