Threat reportPhishingTL-2026-3778
Microsoft Teams Phishing via Fake IT Helpdesk Impersonation (External Chat, Vishing, Screen Sharing, RMM Abuse; VEILDrive and Storm-1811 Patterns)
Microsoft Teams Phishing via Fake IT Helpdesk Impersonation (TL-2026-3778), also tracked as VEILDrive, is a high-severity phishing campaign, first published 2026-10-16. It has no confirmed attribution, affects Microsoft Microsoft Teams (external access / federation, default, maps to 19 MITRE ATT&CK techniques (T1008, T1036.005, T1053.005), and is covered by 9 detection rules and 26 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 19MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 26Indicators of compromise
Key facts for TL-2026-3778
- Threat ID
- TL-2026-3778
- Also known as
- VEILDrive, Teams helpdesk impersonation, Fake IT Helpdesk Teams phishing
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- critical infrastructure, enterprise, cross-sector
- Target regions
- North America, Global
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in Microsoft Teams Phishing via Fake IT Helpdesk Impersonation
Malware and tooling: AnyDesk, Black Basta - S1070, DWAgent, Lite Manager, NetSupport Manager, Quick Assist, ScreenConnect
How Microsoft Teams Phishing via Fake IT Helpdesk Impersonation works
Threat actors abuse Microsoft Teams' default-enabled external collaboration to impersonate IT/helpdesk staff through one-on-one chats and voice calls, share malicious SharePoint links, and abuse screen sharing and meetings to bypass built-in warnings. The pattern leads to remote-access tool installation (Quick Assist, AnyDesk, DWAgent, LiteManager) and has been seen in the VEILDrive campaign and in Storm-1811 Black Basta intrusions.
Hunters (Team AXON) documents a Teams-centric social-engineering pattern. The actor creates a new Entra ID tenant or uses a compromised account/tenant, then contacts a victim through an external one-on-one chat or voice call (vishing), using display names or user IDs containing IT/Help Desk keywords. Non-ASCII characters such as emojis are used to obscure the '(External)' label, and external voice calls display no warning to the victim. The actor searches Teams for email addresses to confirm that targets exist and can be reached externally. Spam/email-bombing floods sometimes precede the contact, creating a pretext for 'help'.
Once trust is established the actor uses screen sharing, meetings (which can bypass built-in warnings), and attempted remote control, then guides the victim into starting a remote monitoring and management (RMM) tool. Hunters names QuickAssist, AnyDesk and DWAgent. Malicious payloads are delivered as SharePoint links in Teams messages; Hunters also notes that attachment contents can be manipulated by intercepting HTTP requests (Burp Suite), referencing public research from In The Cyber.
The VEILDrive campaign (active since early August 2024, investigated by Team AXON from September 2024, published 2024-11-04) targeted a U.S. critical infrastructure company. A compromised account in one organization sent the Teams phishing message impersonating IT; Quick Assist gave interactive access; malware (Client_v8.16L.zip, Cliento.zip) was hosted on a SharePoint tenant of a second compromised organization; and a Java .jar implant ('Cliento.jar', internally ODC2) used OneDrive via the Microsoft Graph API as C2, with an HTTPS socket fallback to an Azure VM. LiteManager components (ROMServer.exe, ROMFUSClient.exe) and a scheduled task named 'Performance monitoring' provided persistence. Team AXON assessed a significant probability of Russian origin.
Microsoft separately documented Storm-1811, a financially motivated actor that email-bombs targets, then impersonates IT/help desk by phone and on Teams (Teams vector adopted from end of May 2024), abuses Quick Assist, deploys ScreenConnect/NetSupport Manager, uses cURL/BITSAdmin for downloads, OpenSSH tunnelling, PsExec, Cobalt Strike, SystemBC, and ultimately Black Basta ransomware. Microsoft has more recently warned of increased abuse of external Teams collaboration with Quick Assist and Rclone for data transfer to external cloud storage.
Detection centres on M365 unified audit log events: ChatCreated (external one-on-one chats from foreign tenants), MessageSent (sender IP, embedded URLs), UserAccepted, MemberAdded, TeamsImpersonationDetected and TIMailData (email bombing). Confidence boosters include *.onmicrosoft.com senders, helpdesk keywords in display name/user ID, non-ASCII characters, recently registered domains, proxy IPs, and IOC-feed hits. Severity indicators are UserAccepted, a victim reply, and MemberAdded with a suspicious sender. The source article provides no IOCs of its own; the IOCs below come from the linked VEILDrive report and Microsoft's Storm-1811 report.
MITRE ATT&CK techniques used in TL-2026-3778
Command and Control
T1008 Fallback Channels; T1102.002 Bidirectional Communication; T1219.002 Remote Desktop Software
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1684.001 Impersonation
Persistence
Execution
T1059.001 PowerShell; T1204.002 Malicious File
Discovery
T1082 System Information Discovery; T1120 Peripheral Device Discovery; T1124 System Time Discovery
Collection
Initial Access
T1566.002 Spearphishing Link; T1566.003 Spearphishing via Service; T1566.004 Spearphishing Voice
Exfiltration
T1567.002 Exfiltration to Cloud Storage
Resource Development
T1585.003 Cloud Accounts; T1586.003 Cloud Accounts
Reconnaissance
Affected products and versions in Microsoft Teams Phishing via Fake IT Helpdesk Impersonation
Remediation for Microsoft Teams Phishing via Fake IT Helpdesk Impersonation
Immediate actions
- Hunt M365 audit logs for ChatCreated events from foreign-tenant users in one-on-one chats, especially *.onmicrosoft.com senders, IT/Help Desk keywords, and non-ASCII display names
- Alert on UserAccepted, victim replies, and MemberAdded events tied to suspicious external senders
- Correlate TIMailData email-bombing spikes with subsequent external Teams contact
- Hunt for javaw.exe spawning PowerShell with -ExecutionPolicy Bypass -NoExit -NoProfile and for the scheduled task 'Performance monitoring' (hunt window from July 2024)
Workarounds
- Disable 'give or request control' for external participants unless operationally necessary
- Restrict external access in the Teams admin center to named trusted domains
Longer-term hardening
- Disable external Teams collaboration by default and allow-list only required partner domains
- Enforce warning banners across all communication types and consider disallowing external voice calls without prior message verification
- Train users that internal IT will not cold-contact them through external Teams chats or calls to request remote access
- Block or uninstall Quick Assist and unapproved RMM tools (AnyDesk, DWAgent, LiteManager, ScreenConnect, NetSupport) where not in use
- Enable attack surface reduction rules, cloud-delivered protection and network protection
Timeline of Microsoft Teams Phishing via Fake IT Helpdesk Impersonation
- Microsoft observes Storm-1811 misusing Quick Assist after vishing victims (mid-April 2024; day approximate).
- Microsoft Threat Intelligence publishes its report on Quick Assist social-engineering attacks leading to Black Basta ransomware.
- Storm-1811 begins using Microsoft Teams messages and calls to impersonate IT/help desk (end of May 2024; day approximate).
- VEILDrive campaign begins (early August 2024; day approximate), abusing Teams, SharePoint, Quick Assist and OneDrive.
- Team AXON responds to a VEILDrive incident at a U.S. critical infrastructure company (September 2024; day approximate).
- Hunters publishes the VEILDrive analysis, including Teams spear-phishing, Quick Assist, SharePoint hosting and OneDrive C2.
Sources cited for Microsoft Teams Phishing via Fake IT Helpdesk Impersonation
- Detecting Microsoft Teams Phishing: Hunting the Fake IT Helpdesk Threat (Hunters Team AXON)
- VEILDrive: Threat Actors Exploit Microsoft Services for Command & Control (Hunters Team AXON)
- Threat actors misusing Quick Assist in social engineering attacks leading to ransomware (Microsoft Threat Intelligence)
- VEILDrive Attack Exploits Microsoft Services to Distribute Malware (The Hacker News)
- Leveraging Microsoft Teams for Initial Access (In The Cyber)
- Microsoft Teams content sharing in meetings (Microsoft Learn)
- Microsoft Teams increasingly abused in helpdesk impersonation attacks (BleepingComputer)
- Windows Quick Assist Anchors Black Basta Ransomware Gambit (Dark Reading)
Detection coverage for TL-2026-3778
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3778 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.