Fake IT help desk on Teams: the email flood, the support call and the remote session

How the attack works

This attack targets employees of businesses and public bodies rather than households. It doesn't need a software vulnerability: the attacker simply persuades a person to let them in. Microsoft described it in May 2024 in connection with Storm-1811, a group deploying Black Basta ransomware, and in March 2026 published another case investigated by its incident response team (DART).

What Microsoft documented

Storm-1811, 2024. The attackers signed victims' email addresses up to large numbers of subscription services, then phoned them posing as IT support that would sort out the spam. From late May 2024 they also messaged and called through Microsoft Teams, from tenants they had created themselves with names such as "Help Desk", "Help Desk IT", "Help Desk Support" and "IT Support". The victim pressed Ctrl+Windows+Q, entered the attacker's code and allowed screen sharing; the attacker then requested control. cURL or BITSAdmin commands pulled down batch files and archives, and some scripts posed as a "spam filter update" that asked for credentials. Microsoft goes on to describe Qakbot, Cobalt Strike, the remote management tools ScreenConnect and NetSupport Manager, OpenSSH tunnelling, and finally Black Basta ransomware pushed across the network with PsExec.

An organisation investigated by DART, November 2025. The attacker repeatedly called several employees on Teams posing as IT support. After two failed attempts, a third employee granted remote access through Quick Assist. The attacker then steered them to a spoofed page asking for corporate credentials, which kicked off further downloads – including a disguised MSI package that sideloaded a malicious DLL to set up command and control. Microsoft says the intrusion was short-lived, the attacker's objectives were not met and no persistence remained (Microsoft, 16 March 2026).

How to spot it (for employees)

• First a flood of email, then instant "help". If someone contacts you about a problem you haven't reported, treat it as a warning sign. Your real IT team is unlikely to know about your inbox before you do.
• The person is outside your organisation. Teams usually presents a chat from someone outside as a request you can accept, block or report (Microsoft Support). A display name of Help Desk proves nothing.
• They want a Quick Assist code or a tool installed. Microsoft's advice is explicit: only let a helper connect if you contacted Microsoft Support or your own IT staff yourself.
• They're in a hurry. "I need to connect now or your mailbox will be locked." Microsoft advises not giving access to anyone claiming an urgent need to reach your device.
• They want your password or a sign-in approval. No support desk will ask for your password in chat or on a page sent during the call. You can check any link they send with our Link checker.

What to configure (for admins)

In both cases Microsoft's main recommendations are to limit who outside the organisation can contact your people on Teams and to remove remote access tools you don't need. Settings are in the Teams admin center (Microsoft Learn):

1. External access for trusted domains only. The default is "Allow all external domains", meaning anyone in any Microsoft 365 organisation can reach your users. Under Users → External access, set "Teams and Skype for Business users in external organizations" to Allow only specific external domains and add the partners you actually work with. Microsoft's 2026 case report recommends exactly this kind of allowlist.
2. Unmanaged Teams accounts. People with personal (free) Teams accounts can contact your users if "People in my organization can communicate with unmanaged Teams accounts" is on and "External users with Teams accounts not managed by an organization can contact users in my organization" is ticked. If you don't need it, turn off at least the second option, ideally both.
3. Keep trial tenants blocked. According to the documentation, communication with trial-only tenants is blocked by default (ExternalAccessWithTrialTenants = Blocked). Leave it that way.
4. Block known attackers. "Block specific users from communicating with people in my organization" blocks individual external addresses (up to 200). With Defender for Office 365, your security team can block domains in the Tenant Allow/Block List on the "Teams domains" tab.
5. Remove Quick Assist if you don't use it. Microsoft recommends uninstalling or blocking Quick Assist and any other remote management tools not in use. To uninstall with PowerShell (as administrator): Get-AppxPackage -Name MicrosoftCorporationII.QuickAssist | Remove-AppxPackage -AllUsers. To block it, block traffic to remoteassistance.support.services.microsoft.com – note this also breaks Remote Help.
6. Use Remote Help for company support. If you need remote support, Microsoft recommends Remote Help in Intune, which authenticates the helper, enforces roles and logs sessions. With Quick Assist, by contrast, the person sharing sees only an abbreviated name for the helper (first name and last initial), so the helper isn't verified in any way.
7. Phishing-resistant sign-in. Microsoft advises requiring phishing-resistant authentication for critical apps (Conditional Access authentication strength). At the very least, turn on two-step verification for every account.

What to watch for in detection

For the Storm-1811 campaign Microsoft lists the Defender for Endpoint alert "Suspicious activity using Quick Assist" alongside related detections for curl and BITSAdmin downloads, NetSupport Manager, Cobalt Strike and ransomware behaviour. Treat this sequence as high risk: a sudden email flood to one person → an external Teams chat or call → Quick Assist or another remote access tool launched → scripts downloaded. If you're pulling indicators out of reports and logs, our IOC extractor can help.

Has the attacker already connected?

1. End the session and disconnect from the network. Microsoft advises disconnecting immediately if you suspect the helper is malicious. Unplug the network cable and turn off Wi-Fi, but don't shut the computer down – evidence in the running system matters for the investigation.
2. Call IT or your security team straight away. Tell them when it happened, the name shown in Teams, what the attacker did and what you typed in. Don't delete the Teams messages.
3. Change your password from another device. If you entered credentials, change your password from your phone or another computer and ask IT to sign out all sessions. In the documented cases attackers also stole sign-in sessions, so a password change alone may not be enough. Our general guide is I entered my details on a phishing site.
4. IT: treat it as an incident, not user error. Check the device (new services, scheduled tasks, installed remote management tools, outbound connections), the account's sign-ins and mailbox rules. Block the attacker in Teams and warn colleagues – in the 2026 case the attacker worked through several employees in turn.

Where to report it

• Inside your organisation: your IT or security team, even if you didn't let the attacker in. The next colleague may be less lucky.
• UK: if you've lost money, report it to Report Fraud at reportfraud.police.uk (England, Wales and Northern Ireland); in Scotland, call Police Scotland on 101.
• US: report it to the FBI's Internet Crime Complaint Center (IC3).
• Microsoft: misuse of Quick Assist via the tech support scam form linked from the Quick Assist documentation (see sources).

A similar trick targets home users – "Microsoft" calling to say your PC has a virus. We cover that in Tech support scams: what to do. Businesses may also want our guide to invoice fraud and changed bank details.