Fake IT Help Desk Chats in Microsoft Teams: Lock Down External Access
Attackers are burying staff inboxes in spam, then messaging them on Teams pretending to be IT support. Arctic Wolf has tracked more than 400 incidents, and your Microsoft 365 setup probably allows it by default.
Arctic Wolf's research, reported by Help Net Security and flagged again in Check Point's 2 November threat report, describes a simple chain. A user's inbox fills with hundreds of newsletter confirmations. Minutes later an external Teams contact called something like "IT Service Desk (Internal)" offers to fix it, moves to a voice call, and asks them to open Quick Assist and read back a six-digit code. From there it's remote access, credential theft and, in some cases, ransomware. Malicious code can be running within 15 minutes.
Who's affected
Any business on Microsoft 365, because external Teams chat is switched on by default. There's no vulnerability to patch. The attack works on trust, which is why it slips past a lot of security tools.
What to do today
- Lock down external chat. Set Teams external access to specific trusted domains only, or off, and block unmanaged Teams accounts.
- Restrict remote tools. Limit Quick Assist and other remote access tools to approved IT staff.
- Brief your team. IT will never start a Teams chat to fix a spam flood. If in doubt, hang up and call your IT provider on a number you already know.
2nd November Threat Intelligence Report, Check Point Research
Frequently Asked Questions
How do I stop outside users messaging my staff on Teams?
In the Teams admin centre, go to External access and allow only specific trusted domains, or turn it off if you don't need it. Also block unmanaged Teams accounts.
Why do attackers flood an inbox first?
It creates a believable problem. When a fake IT person appears minutes later offering to fix it, the victim is far more likely to accept the help.
What is Quick Assist and why is it targeted?
Quick Assist is a remote support tool built into Windows. The victim only has to read out a six-digit code, so it is the attackers' favourite way in.
What should staff do if someone claiming to be IT contacts them?
Stop, don't install anything, and call your real IT provider on a number you already have to confirm the request.
Not sure how your Teams is set up?
We'll review your external access and remote tool settings and tell you what to tighten.
Related Guide
Cybersecurity for Sydney SMBs
Explore our complete guide to protecting your business from cyber threats.
Read the Full Guide →