Fake IT Support in Teams Chats Leads to Remote Access and Malware

Key points

• Impersonators contact staff through Teams chats from outside the organization.
• The goal is to persuade employees to allow remote access to their PCs.
• Successful lures can lead to malicious software on company machines.
• No CVE is involved; this is social engineering, not a software flaw.

Cybercriminals are contacting staff through Microsoft Teams, but from conversations that originate outside the organization. They pretend to be internal tech support and use social engineering to build trust. The objective is to get an employee to permit remote control of an organization-issued PC. Once that happens, the intruder can install malicious software and reach corporate systems. No CVE is associated with this activity; it abuses user trust rather than a software vulnerability.

The people at risk are employees and their work computers, especially those who accept Teams chats from external parties. Because help-desk impersonation feels routine, a single successful conversation can expose a device. The remote-access step is the pivot: it turns a chat into hands-on access to company PCs.

This matters for K-12 and government environments that rely on Teams for daily operations. External collaboration expands the reach of attackers, and they do not need an exploit when they can exploit workflow. Watch for unsolicited IT requests, external-chat labels, urgency, requests to install remote-support tools, screen-sharing prompts, and credential requests.

Microsoft Teams is a legitimate platform, and external chats are a feature, not a flaw. Security teams should verify identity out-of-band, limit external communications, and train staff to challenge unexpected support requests. Monitor remote-control tool installations and unusual Teams external conversations. Severity is medium because the attack requires user action, but impact can be high if remote access is granted.

What to do now

1. Publish a same-day advisory telling staff that IT will never request remote-control access through an unsolicited Teams chat; require call-back verification using a known help-desk number.
2. Restrict Teams external access and federation to approved domains; review existing external-chat policies and block consumer tenants where not needed.
3. Block or require approval for common remote-support tools on endpoints; alert on new installations and unexpected remote sessions.
4. Enable and monitor audit logs for Teams external chats, file transfers, and screen-sharing events; forward them to the SIEM.
5. Enforce MFA and conditional access; review accounts that granted remote access for anomalous sign-ins.
6. Run targeted social-engineering training with Teams-specific examples and provide an easy reporting button.
7. If compromise is suspected, isolate the device, revoke sessions and tokens, reset credentials, and preserve logs.

Original source

Hackread