Microsoft: Teams increasingly abused in helpdesk impersonation attacks
The attacks were already running before Microsoft put a name on them. That is the detail that deserves more attention than it usually gets. According to BleepingComputer's reporting, these helpdesk impersonation campaigns were active in early 2025, which means attackers had a quiet runway of weeks, possibly months, before the pattern was formally identified and surfaced. The technique itself is what separates this from a standard phishing attempt: rather than arriving in email — where filters have had years of training — the approach exploits Microsoft Teams directly. An attacker poses as internal IT support, reaches a target through Teams chat or call, and from there the social engineering has all the credibility that an authenticated-looking company platform provides. The target isn't reading a suspicious link in their inbox; they're having what feels like a routine conversation with someone who appears to belong. That contextual legitimacy is the attack's actual weapon, and it works precisely because Teams has been positioned as a trusted internal space.
If confirmed, here is what this means. Every organisation running Microsoft Teams — which is to say, most of the enterprise world — has a gap in its social engineering defences that email-focused security training does not address. Employees have been taught to distrust unexpected emails from IT; they have not been taught to distrust unexpected Teams messages from IT, because until recently that channel wasn't being systematically abused. Security awareness programmes need to extend the same scepticism to Teams interactions that they apply to email: verify identity through a second channel before following any instruction, regardless of how official the conversation looks. IT helpdesks themselves may need to establish clear authentication protocols for outbound contact — a shared codeword, a ticket number — so that legitimate requests can be distinguished from impersonation. The second-order effect is subtler: as defenders adapt and Teams-specific training becomes standard, attackers will rotate to whichever collaboration platform has the most trust and the least scrutiny. This is less a Teams problem than it is a pattern about how trust migrates across tools, and defenders who solve it only for Teams will find the same technique arriving via Slack, Zoom, or whatever comes next.
Watch for Microsoft issuing updated guidance or platform-level controls specifically addressing external or unexpected helpdesk-style contact in Teams. A second independent outlet confirming the campaign details would also move this story out of pinch-of-salt territory and warrant a harder look at internal policies.
Threat actors are impersonating IT support staff in Microsoft Teams calls to gain remote access to corporate devices and deploy Chaos ransomware in attacks targeting North
Threat actors are abusing Microsoft Teams voice calls by impersonating corporate IT support staff to trick employees into installing the EtherRAT malware, giving attackers initial
A threat actor targeting Microsoft 365 and Azure production environments is stealing data in attacks that abuse legitimate applications and administration features. [...]
Initial access broker KongTuke has moved to Microsoft Teams for social engineering attacks, taking as little as five minutes to gain persistent access to corporate networks. [...]
Microsoft has disclosed details of two campaigns in which threat actors are abusing third-party email delivery infrastructure to blast financial fraud scam messages and using
NewsHive monitors these sources continuously. All signal titles above link to the original reporting.
Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →