Hackers use Microsoft Teams chats to impersonate IT helpdesk staff
Microsoft has warned that cyber criminals are abusing external chats in Teams to pose as IT support workers. Attackers contact users through these chats and trick them into granting remote access using tools like Quick Assist. From there, they carry out reconnaissance, deploy malware and steal data. The attacks use standard Microsoft tools and protocols, such as WinRM for remote management. This makes them hard to spot because they blend with legitimate helpdesk activity. External collaboration features in Teams enable the initial contact. No figures on attack numbers were given, but Microsoft says the tactic is on the rise.
Before, external chats in Teams let support teams help guests or contractors without complex setups. Admins managed risks through guest invites and basic permissions, assuming monitored access kept things safe amid Teams sprawl. Now attackers exploit those same chats for targeted impersonation, turning everyday user requests into breach entry points. With hundreds of unmanaged teams, this amplifies hidden guest access from ex-employees, making compliance audits urgent and detection reliant on policy over tools.
Analysis
Your Teams sprawl already drowns you in support tickets; this attack proves external chats are the next compliance trap nobody audits. Lock it down: In the Teams admin center, set policy to block all external chat and federation tenant-wide, then audit and revoke existing guests before users hand over Quick Assist.
Pulse published by Collab365 Spaces. Cite as "Hackers use Microsoft Teams chats to impersonate IT helpdesk staff", Collab365 Spaces.