Scams & Fraud

That Teams Call From IT Support May Be an Outsider

By Lena Ortiz / October 18, 2026 / Updated November 8, 2026

Laptop screen showing a participant in a video meeting

Quick answer: If someone you have never met messages or calls you on Microsoft Teams, says they are IT, and asks you to share your screen, install something or hand over control, stop and check them through a channel you already trust. Palo Alto Networks’ Unit 42 documented exactly this pattern in its “Spring Ring” report, published August 31, 2026. It covers activity from January through April 2026 and more than 150 employees at no fewer than 10 organizations. The attackers did not need a Microsoft bug. They needed one person to say yes to a friendly-sounding “technician.”

Key takeaways

This is a trust trick, not a software hole. Unit 42 found no evidence of a flaw in Microsoft’s products, and Microsoft’s own write-ups say the same.
The usual script: an outside account with an IT-style name chats you, then calls you, then pushes you toward a remote-control tool.
Your rule of thumb: only let IT in if you started the contact through a route you already know. Microsoft’s Quick Assist documentation agrees.
If you already said yes, end the session and tell your real security team what you clicked, installed or approved.
As of November 8, 2026, the pattern is still active in Microsoft’s published research, with a new write-up on October 30.

What Unit 42 actually found

According to the report, attackers set up their own Microsoft 365 tenants (basically their own company accounts) with names that looked like corporate IT. From those outside accounts they sent employees direct Teams chats, then followed up with voice calls to add pressure. Some used names resembling real IT staff, some left voicemails, and the connections often came through commercial VPN services.

The researchers described two flavors. In the first, victims were asked to open Windows’ built-in Quick Assist or a third-party remote management tool. That handed the caller control, and the caller then ran a command that downloaded a remote access trojan, which is software that lets an outsider operate a machine. In the second, victims were asked to download a company-themed program from a cloud storage link.

What has changed since the original story

The core story still holds. Microsoft’s April 18, 2026 Defender post described outside-tenant attackers posing as IT with lures like a “security update,” a “spam filter update” or “account verification,” sometimes combined with voice calls, before steering victims into a remote support session, usually Quick Assist.

On October 30, 2026, Microsoft published a follow-up on two intrusions that began the same way, and said no Teams vulnerability was involved. In both, the attackers moved on from the first workstation toward the company’s identity systems. In one case data was copied to an outside server. In the other, the customer isolated the workstation after alerts and no further progress was observed.

I searched for a newer government advisory specific to Teams and found none as of November 8, 2026. The closest primary source is the joint FBI and CISA advisory on the Scattered Spider group (AA23-320A, first issued November 16, 2023, last revised July 29, 2025). It describes the older phone-and-text version: posing as help desk staff to get employees to install legitimate remote tools or share one-time codes. The channel changes. The con does not.

Spot the pattern, then check it safely

Think of this as a cheat sheet for the next time a “Help Desk” avatar pops up in your chat.

What you see	Why it works	Safe check
An outside account named like “IT Support”	A display name costs nothing. Microsoft says Teams’ external labels and first-contact prompts only help if people heed them.	Check the full sender identity and domain. Treat the Accept/Block prompt as a real decision.
A chat that turns into a call fast	Voice adds pressure and speed, the sequence Unit 42 describes.	End the call and reach IT through a ticket system or number you already have.
A routine reason: security update, spam filter, account check	These are the lures Microsoft lists. They are boring on purpose.	Ask your manager or the real help desk whether such a task exists.
A request to open Quick Assist or install a remote tool	The tools are legitimate. CISA notes they are not malicious on their own, so a familiar brand proves nothing.	Microsoft: only allow a helper in if you started the contact with Microsoft Support or your own IT staff.
A link or file to open during the call	Microsoft notes attackers often skip links in chat and have victims browse to them live.	Do not download or open anything during a call you did not start.
A request for a password or one-time code	CISA describes attackers posing as IT to collect one-time passcodes.	Never share them. A real technician does not need your sign-in codes.

Safe checks you can use today

None of this needs special software, just a little stubbornness.

Close the chat and contact IT through the number, portal or ticket system you already know, not one supplied in the conversation.
Check the sender’s full name and domain, and note whether Teams marks the account as external.
Ask a coworker or your manager whether the request is real.
If your company uses an agreed code phrase for help desk calls, use it. Microsoft suggests this kind of verbal check.
Do not approve screen sharing, remote control or permission prompts in a session you did not start. Microsoft says it does not contact people out of the blue to request device access.

If you run IT

Microsoft’s posts point to a few levers: review external collaboration settings, limit external access to real business needs, allow only approved remote-support tools, and restrict Quick Assist to authorized roles. Its Quick Assist page says to disable or remove it where an alternative such as Intune Remote Help is in use. Check Microsoft’s current admin documentation for setting names.

If you already let someone in

End the session immediately. Microsoft says to disconnect right away if you suspect the person on your device is malicious.
Do not let the caller “help” with cleanup. They are the problem.
Contact your real security team or help desk through a route you already know.
Tell them everything you clicked, installed, typed or approved, and hand over the sender details.
Change any password you shared. The FTC gives this advice for tech support scams. At work, ask your security team how.
If it happened on a personal computer, report it to the FTC at ReportFraud.ftc.gov.

Why the rush? In Microsoft’s October 30 cases, the attackers did not stay on the first machine. They went looking for more privileged accounts, so early reporting gives defenders a chance to contain things.

Frequently asked questions

Is this a Microsoft Teams vulnerability?

No. Unit 42 reported no evidence of a flaw in Microsoft’s products, and Microsoft’s October 30 post says no Teams vulnerability was involved. The attackers misuse normal features, like outside chat and remote support, and rely on trust.

Does an “External” label mean I’m safe?

Not by itself. Microsoft says its warnings only work if users pay attention. An outside label on a message claiming to come from your own IT department is a reason to slow down.

What if the caller knows my name and job?

That proves less than you would think. Unit 42 saw names resembling real IT staff, and CISA notes attackers research employees using social media and leaked data.

What about scams on my home computer?

The FTC says legitimate tech companies do not contact you out of the blue about computer problems. Do not give remote access, get help from a known provider at a number you know is real, and report scams at ReportFraud.ftc.gov.

Before you decide

Treat a stranger offering to fix something you never reported like an unexpected knock at the door. You can be polite and still say, “I’ll contact IT myself.” A real technician will not mind. A fake one will keep pushing, and the pushing is the clue.

Three habits cover most of it: verify through a route you already know, never hand over control or codes in a session you did not start, and report quickly if you slip.