Teams IT Support Impersonation Scams Deliver Ransomware via Trusted Remote Access Tools
Written by AI from the linked story. Not reviewed by an editor. How this works
Threat actors are exploiting Microsoft Teams' external chat functionality to impersonate IT support personnel, first overwhelming users with mail bombs to manufacture urgency, then convincing them to grant remote access via legitimate RMM tools. Because the attackers use real Microsoft 365 tenants with convincing IT-themed display names, users have little technical signal to distinguish the scam from genuine helpdesk contact. Once remote access is granted, attackers deploy ransomware, backdoors, and conduct lateral movement — all under the cover of trusted software. This campaign highlights how social engineering can completely bypass technical controls when users are not trained to verify identity through out-of-band channels. The widespread enablement of external Teams access without compensating controls creates a large, exploitable attack surface.
Tactical Insight
Immediate actions
- Restrict or disable Microsoft Teams external access from unknown/unmanaged tenants via the Teams Admin Center, allowing only verified partner domains.
- Train users to never grant remote access to anyone who initiates contact through chat alone — always require verification through a known, internal IT ticketing or callback process.
- Block or alert on RMM tools (e.g., AnyDesk, ScreenConnect) that are not sanctioned by the organization at the endpoint and network level.
Long-term improvements
- Implement a formal IT support identity verification policy requiring multi-step out-of-band confirmation before any remote session is permitted.
- Enforce Conditional Access policies and privileged access workstations so that even a compromised session has limited lateral movement capability.
- Maintain an allowlist of approved communication channels and remote access tools, and auto-block all others via endpoint policy.
Detection measures
- Deploy SIEM alerting for unusual RMM tool installations or executions, especially those initiated outside of change windows or by non-IT user accounts.
- Monitor Microsoft Teams logs for inbound external chat messages referencing IT support, credentials, or remote access requests and route them to the SOC for review.
- Enable mail flow anomaly detection to flag mail bombing patterns as a leading indicator of a follow-on social engineering attempt.