# Microsoft Teams Phishing via Fake IT Helpdesk Impersonation (External Chat, Vishing, Screen Sharing, RMM Abuse; VEILDrive and Storm-1811 Patterns)

> Threat actors abuse Microsoft Teams' default-enabled external collaboration to impersonate IT/helpdesk staff through one-on-one chats and voice calls, share malicious SharePoint links, and abuse screen sharing and meetings to bypass built-in warnings. The pattern leads to remote-access tool installation (Quick Assist, AnyDesk, DWAgent, LiteManager) and has been seen in the VEILDrive campaign and in Storm-1811 Black Basta intrusions.

- **Published:** 2026-10-16T21:32:41Z
- **Last reviewed:** 2026-10-16T21:32:41Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3778
- **ID:** TL-2026-3778
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Hunters (Team AXON) documents a Teams-centric social-engineering pattern. The actor creates a new Entra ID tenant or uses a compromised account/tenant, then contacts a victim through an external one-on-one chat or voice call (vishing), using display names or user IDs containing IT/Help Desk keywords. Non-ASCII characters such as emojis are used to obscure the '(External)' label, and external voice calls display no warning to the victim. The actor searches Teams for email addresses to confirm that targets exist and can be reached externally. Spam/email-bombing floods sometimes precede the contact, creating a pretext for 'help'.

Once trust is established the actor uses screen sharing, meetings (which can bypass built-in warnings), and attempted remote control, then guides the victim into starting a remote monitoring and management (RMM) tool. Hunters names QuickAssist, AnyDesk and DWAgent. Malicious payloads are delivered as SharePoint links in Teams messages; Hunters also notes that attachment contents can be manipulated by intercepting HTTP requests (Burp Suite), referencing public research from In The Cyber.

The VEILDrive campaign (active since early August 2024, investigated by Team AXON from September 2024, published 2024-11-04) targeted a U.S. critical infrastructure company. A compromised account in one organization sent the Teams phishing message impersonating IT; Quick Assist gave interactive access; malware (Client_v8.16L.zip, Cliento.zip) was hosted on a SharePoint tenant of a second compromised organization; and a Java .jar implant ('Cliento.jar', internally ODC2) used OneDrive via the Microsoft Graph API as C2, with an HTTPS socket fallback to an Azure VM. LiteManager components (ROMServer.exe, ROMFUSClient.exe) and a scheduled task named 'Performance monitoring' provided persistence. Team AXON assessed a significant probability of Russian origin.

Microsoft separately documented Storm-1811, a financially motivated actor that email-bombs targets, then impersonates IT/help desk by phone and on Teams (Teams vector adopted from end of May 2024), abuses Quick Assist, deploys ScreenConnect/NetSupport Manager, uses cURL/BITSAdmin for downloads, OpenSSH tunnelling, PsExec, Cobalt Strike, SystemBC, and ultimately Black Basta ransomware. Microsoft has more recently warned of increased abuse of external Teams collaboration with Quick Assist and Rclone for data transfer to external cloud storage.

Detection centres on M365 unified audit log events: ChatCreated (external one-on-one chats from foreign tenants), MessageSent (sender IP, embedded URLs), UserAccepted, MemberAdded, TeamsImpersonationDetected and TIMailData (email bombing). Confidence boosters include *.onmicrosoft.com senders, helpdesk keywords in display name/user ID, non-ASCII characters, recently registered domains, proxy IPs, and IOC-feed hits. Severity indicators are UserAccepted, a victim reply, and MemberAdded with a suspicious sender. The source article provides no IOCs of its own; the IOCs below come from the linked VEILDrive report and Microsoft's Storm-1811 report.

## MITRE ATT&CK

- T1589.002 Email Addresses
- T1586.003 Cloud Accounts
- T1585.003 Cloud Accounts
- T1566.003 Spearphishing via Service
- T1566.004 Spearphishing Voice
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1053.005 Scheduled Task
- T1684.001 Impersonation
- T1036.005 Match Legitimate Resource Name or Location
- T1082 System Information Discovery
- T1124 System Time Discovery
- T1120 Peripheral Device Discovery
- T1113 Screen Capture
- T1219.002 Remote Desktop Software
- T1102.002 Bidirectional Communication
- T1008 Fallback Channels
- T1567.002 Exfiltration to Cloud Storage

## Sources

- [Detecting Microsoft Teams Phishing: Hunting the Fake IT Helpdesk Threat (Hunters Team AXON)](https://www.hunters.security/en/blog/microsoft-teams-phishing-fake-it-helpdesk)
- [VEILDrive: Threat Actors Exploit Microsoft Services for Command & Control (Hunters Team AXON)](https://www.hunters.security/en/blog/veildrive-microsoft-services-malware-c2)
- [Threat actors misusing Quick Assist in social engineering attacks leading to ransomware (Microsoft Threat Intelligence)](https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/)
- [VEILDrive Attack Exploits Microsoft Services to Distribute Malware (The Hacker News)](https://thehackernews.com/2024/11/veildrive-attack-exploits-microsoft.html)
- [Leveraging Microsoft Teams for Initial Access (In The Cyber)](https://posts.inthecyber.com/leveraging-microsoft-teams-for-initial-access-42beb07f12c4)
- [Microsoft Teams content sharing in meetings (Microsoft Learn)](https://learn.microsoft.com/en-us/microsoftteams/meeting-policies-content-sharing)
- [Microsoft Teams increasingly abused in helpdesk impersonation attacks (BleepingComputer)](https://www.bleepingcomputer.com/news/security/microsoft-teams-increasingly-abused-in-helpdesk-impersonation-attacks/)
- [Windows Quick Assist Anchors Black Basta Ransomware Gambit (Dark Reading)](https://www.darkreading.com/threat-intelligence/windows-quick-assist-anchors-black-basta-ransomware)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3778