Hackers use Microsoft Teams chats to impersonate IT helpdesk staff

Microsoft has warned that cyber criminals are abusing external chats in Teams to pose as IT support workers. Attackers contact users through these chats and trick them into granting remote access using tools like Quick Assist. From there, they carry out reconnaissance, deploy malware and steal data. The attacks use standard Microsoft tools and protocols, such as WinRM for remote management. This makes them hard to spot because they blend with legitimate helpdesk activity. External collaboration features in Teams enable the initial contact. No figures on attack numbers were given, but Microsoft says the tactic is on the rise.