# Microsoft Teams Phishing: Attackers Impersonate IT Helpdesk for Initial Access

> Threat actors abuse Microsoft Teams' default external-collaboration settings to impersonate IT helpdesk staff via one-on-one chat, unbannered vishing calls, and screen-share requests, then deliver files through Burp Suite-manipulated SharePoint links and install RMM tools (Quick Assist, AnyDesk, DWAgent) for persistent remote access.

- **Published:** 2026-08-24T00:00:00Z
- **Last reviewed:** 2026-08-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2129
- **ID:** TL-2026-2129
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Team AXON (Hunters) documents an initial-access technique class in which external actors exploit Microsoft Teams' default "external organizations communication" setting, which lets senders outside a Microsoft 365 tenant message and call organizational users without prior vetting. Attackers stand up new or compromised Entra ID tenants (commonly on the default *.onmicrosoft.com subdomain, often domains registered shortly before use), enumerate valid targets through Teams' built-in external-user email search, and then make first contact impersonating IT/helpdesk personnel, in some cases preceded by an email-bombing burst to manufacture a plausible pretext for a support call. Contact happens through one-on-one chat with spoofed display names such as "Help Desk," through voice-phishing (vishing) calls that Teams allows an unvetted external sender to place with no warning pop-up on the victim's side (unlike chat, where an "(External)" tag is shown, and which attackers further obscure by inserting non-ASCII/emoji characters), or through meeting invitations where the external-sender warning is not consistently enforced once the victim answers.

Because the Teams client does not allow file attachments to be sent to external one-on-one chats through the GUI, attackers use an intercepting proxy (Burp Suite) to modify the underlying HTTP request and inject a SharePoint file-sharing link directly into the chat message, bypassing the restriction. Because the link points at a SharePoint object rather than an inline attachment, the attacker can swap the file's contents after the link has already been delivered and trusted by the victim. Once initial trust is established -- often reinforced by a live screen-sharing session that Teams permits by default -- the victim is walked through installing a legitimate remote-monitoring-and-management (RMM) tool (Quick Assist, AnyDesk, or DWAgent), giving the attacker hands-on-keyboard remote access to the endpoint that persists after the call ends.

Hunters explicitly frames this as a fast-rising, actively evolving technique class rather than a single incident, citing their own November 2024 VEILDrive research (Sangria Tempest / Storm-1674 abusing Teams, SharePoint, Quick Assist, and OneDrive as C2 against a U.S. critical-infrastructure target) as the precedent that established Teams-based initial access as repeatable tradecraft. That framing is corroborated by a wave of independently-attributed campaigns using the same helpdesk-impersonation-via-Teams pretext but different tooling: Microsoft's own October 2025 advisory names Storm-1811, Octo Tempest, Midnight Blizzard, Void Blizzard, Sangria Tempest, Storm-1674, and Peach Sandstorm as actors abusing Teams for initial access, delivery, or credential capture; Storm-1811 specifically pairs this pretext with Quick Assist to deliver Black Basta ransomware; and later, unrelated campaigns (UNC6692's SNOWBELT/SNOWBASIN/SNOWGLAZE malware suite reported April 2026, and an EtherRAT-via-HopToDesk/AnyDesk campaign reported July 2026) show the same Teams helpdesk-impersonation pretext still being used by different, separately-attributed actors well into 2026. The Hunters source itself provides no threat-actor attribution, malware family, or network IOC for the specific campaign it documents -- its contribution is the initial-access/delivery tradecraft and the M365 unified-audit-log detection methodology (ChatCreated, MessageSent, UserAccepted, TeamsImpersonationDetected, and TIMailData events) used to hunt for it.

Three later, independently-attributed campaigns fill in the technical follow-on detail this class of attack produces once trust is established. Palo Alto Networks Unit 42 (June 2026) retrospectively attributes the earliest confirmed nation-state use of this exact pretext to Cloaked Ursa (APT29 / Midnight Blizzard), which operationalized Teams-based helpdesk impersonation in late 2024 using compromised partner/vendor accounts to send credential-harvesting links to spoofed Microsoft login portals, paired with MFA-approval-request manipulation to complete the account takeover once a password was captured. Mandiant's UNC6692 cluster (active December 2025, reported April 2026) impersonates IT helpdesk staff via an email-bombing burst followed by a Teams chat offering a fake "Mailbox Repair and Sync Utility v2.1.5"; the link downloads an AutoHotkey loader script from an attacker-controlled AWS S3 bucket. The script runs a gatekeeper routine to restrict execution to intended targets and evade automated sandboxes, then launches Microsoft Edge headless with the `--load-extension` flag to silently install a malicious Chromium extension named SNOWBELT, whose fake "Health Check" button re-prompts the victim for mailbox credentials. The same loader deploys the SNOWBELT JavaScript backdoor and the SNOWBASIN persistent backdoor (a local HTTP listener on ports 8000-8002 supporting remote command execution, screenshotting, and file operations), tunneled out via the SNOWGLAZE Python WebSocket relay. Finally, a July 2026 campaign reported by Unit 42's Brian Janower (via The Register) reuses the identical fake-IT-support-over-Teams pretext, this time walking victims through installing HopToDesk or AnyDesk to deliver EtherRAT, a cross-platform (Windows/Linux/macOS) Node.js RAT that resolves its C2 server address from an Ethereum smart contract ("EtherHiding"-style blockchain dead-drop resolution) with conventional domains as fallback; Teams itself leaves a forensic artifact of the abused screen-control session in files prefixed `CtrlVirtualCursorWin_*`.

## MITRE ATT&CK

- T1589.002 Email Addresses
- T1598.004 Spearphishing Voice
- T1585.002 Email Accounts
- T1586.002 Email Accounts
- T1608.005 Link Target
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1684.001 Impersonation
- T1219 Remote Access Tools
- T1583.001 Domains
- T1583.006 Web Services
- T1566.004 Spearphishing Voice
- T1204.002 Malicious File
- T1059.010 AutoHotKey & AutoIT
- T1176 Software Extensions
- T1497 Virtualization/Sandbox Evasion
- T1621 Multi-Factor Authentication Request Generation
- T1102.001 Dead Drop Resolver

## Sources

- [Detecting Microsoft Teams Phishing: Hunting the Fake IT Helpdesk Threat](https://www.hunters.security/en/blog/microsoft-teams-phishing-fake-it-helpdesk)
- [Leveraging Microsoft Teams for Initial Access](https://posts.inthecyber.com/leveraging-microsoft-teams-for-initial-access-42beb07f12c4)
- [Unmasking VEILDrive: Threat Actors Exploit Microsoft Services for C2](https://www.hunters.security/en/blog/veildrive-microsoft-services-malware-c2)
- [VEILDrive Attack Exploits Microsoft Services to Evade Detection and Distribute Malware](https://thehackernews.com/2024/11/veildrive-attack-exploits-microsoft.html)
- [Threat actors misusing Quick Assist in social engineering attacks leading to ransomware](https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/)
- [Storm-1811, Group G1046](https://attack.mitre.org/groups/G1046/)
- [Disrupting threats targeting Microsoft Teams](https://www.microsoft.com/en-us/security/blog/2025/10/07/disrupting-threats-targeting-microsoft-teams/)
- [UNC6692 Impersonates IT Help Desk via Microsoft Teams to Deploy SNOW Malware](https://thehackernews.com/2026/04/unc6692-impersonates-it-helpdesk-via.html)
- [When "Hi, This Is IT" Comes Through Microsoft Teams](https://unit42.paloaltonetworks.com/microsoft-teams-phishing/)
- [Fake IT bods on Microsoft Teams coax workers into installing malware](https://www.theregister.com/cyber-crime/2026/07/07/fake-it-bods-on-microsoft-teams-coax-workers-into-installing-malware/5267610)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2129