Microsoft Teams Phishing via Fake IT Helpdesk Impersonation (External Tenant Social Engineering)

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5820 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5820 Teams External One-on-One Chat from Fake IT Helpdesk / onmicrosoft.com Tenant

Detects Microsoft Teams audit events (ChatCreated, MessageSent, MemberAdded, UserAccepted, TeamsImpersonationDetected) where a foreign-tenant user opens a one-on-one chat and either uses a default .onmicrosoft.com identity or a helpdesk-style display name (Help Desk Manager, IT Support, Service Desk). This is the initial social-engineering contact used before Quick Assist / RMM sessions (AnyDesk, DWAgent, ScreenConnect) in the fake-IT-helpdesk Teams phishing campaigns and the earlier VEILDrive activity. Maps to T1566.003, T1598.004, T1585.003 and T1586.003.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.003, T1598.004, T1585.003, T1586.003
• Data sources: o365:management:activity (Microsoft Teams audit), CloudAppEvents, Microsoft 365 Unified Audit Log
• Severity: high
• Confidence: high

Splunk SPL

index=o365 sourcetype="o365:management:activity" Workload=MicrosoftTeams earliest=-24h Operation IN ("ChatCreated","MessageSent","MemberAdded","UserAccepted","TeamsImpersonationDetected")
| eval tl_ref="TL-2026-5820"
| eval actor=lower(UserId)
| eval member_names=lower(coalesce(mvjoin('Members{}.DisplayName',"|"),"")." ".coalesce(mvjoin('Members{}.UPN',"|"),""))
| eval helpdesk_name=if(match(member_names,"(help ?desk|it[ _-]?support|service ?desk|it admin|system admin|technical support|it department)"),1,0)
| eval default_tenant=if(match(actor." ".member_names,"onmicrosoft[.]com"),1,0)
| eval foreign=lower(tostring(HasForeignTenantUsers))
| where (foreign="true" AND (isnull(CommunicationType) OR lower(CommunicationType)="oneonone") AND (helpdesk_name=1 OR default_tenant=1)) OR Operation="TeamsImpersonationDetected"
| stats count AS events min(_time) AS first_seen max(_time) AS last_seen values(Operation) AS operations values(ClientIP) AS src_ip dc(ChatThreadId) AS chat_threads max(helpdesk_name) AS helpdesk_name max(default_tenant) AS onmicrosoft_tenant values(tl_ref) AS tl_ref BY actor
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

CloudAppEvents
| where Timestamp > ago(24h)
| where Application == "Microsoft Teams"
| where ActionType in ("ChatCreated", "MessageSent", "MemberAdded", "UserAccepted", "TeamsImpersonationDetected")
| extend Raw = parse_json(RawEventData)
| extend Foreign = tostring(Raw.HasForeignTenantUsers), CommType = tostring(Raw.CommunicationType), MemberText = tolower(tostring(Raw.Members)), Actor = tolower(coalesce(tostring(Raw.UserId), AccountId))
| where ActionType == "TeamsImpersonationDetected"
    or (Foreign =~ "true" and CommType in~ ("OneOnOne", "")
        and (Actor has "onmicrosoft.com" or MemberText has "onmicrosoft.com"
             or MemberText matches regex "(help ?desk|it[ _-]?support|service ?desk|it admin|system admin|technical support|it department)"))
| summarize Events = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Operations = make_set(ActionType), SourceIPs = make_set(IPAddress), Chats = dcount(tostring(Raw.ChatThreadId)) by Actor
| order by LastSeen desc

Sigma

title: Teams External Helpdesk Impersonation Chat from Foreign or onmicrosoft.com Tenant (TL-2026-5820)
id: 7c3e5a10-4b2d-4f6e-8a91-0d2c6b7e1a01
status: experimental
description: Detects Microsoft Teams audit events where a foreign-tenant user starts a one-on-one chat using a default onmicrosoft.com identity or a helpdesk-style display name, the initial contact stage of fake IT helpdesk Teams phishing that precedes Quick Assist or RMM sessions.
references:
  - https://www.hunters.security/en/blog/microsoft-teams-phishing-fake-it-helpdesk
  - https://microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access
author: Threadlinqs Team
date: 2026/11/12
tags:
  - attack.initial-access
  - attack.t1566.003
  - attack.reconnaissance
  - attack.t1598.004
  - attack.resource-development
  - attack.t1585.003
  - attack.t1586.003
logsource:
  product: m365
  service: audit
detection:
  selection_base:
    Workload: MicrosoftTeams
    Operation:
      - ChatCreated
      - MessageSent
      - MemberAdded
      - UserAccepted
    HasForeignTenantUsers: 'true'
    CommunicationType: OneOnOne
  selection_actor:
    UserId|contains: 'onmicrosoft.com'
  selection_name:
    Members|contains:
      - 'help desk'
      - 'helpdesk'
      - 'it support'
      - 'service desk'
      - 'it admin'
      - 'system admin'
      - 'technical support'
  selection_impersonation:
    Operation: TeamsImpersonationDetected
  condition: (selection_base and (selection_actor or selection_name)) or selection_impersonation
falsepositives:
  - Legitimate partner or MSP support staff contacting users from a managed onmicrosoft.com tenant
  - Vendor help desks with approved external-access federation
level: high

Known false positives:

• Approved MSP or vendor support staff chatting from their own onmicrosoft.com tenant
• Partner organisations with federated Teams access whose staff use titles such as IT Support in display names

Tuning notes: Allowlist trusted partner tenant domains and known MSP accounts. Correlate with an email-volume spike (TIMailData / mail flow) to the same recipient in the preceding hours to raise fidelity. Community TL_OSINT_Scan matched two medium-confidence Teams-themed campaigns but supplied no corroborated IOCs, so this rule is behaviour-first. Requires Unified Audit Logging and Teams event ingestion.

• 🔒 TL-2026-5820 Quick Assist and Unapproved RMM Tool Execution (AnyDesk, DWAgent, ScreenConnect, LiteManager) · unlock with TL Creds
• 🔒 TL-2026-5820 Post-Access Active Directory and Host Discovery Burst from Script or RMM Parent · unlock with TL Creds
• 🔒 TL-2026-5820 WinRM Lateral Movement from Implant or Fan-out PowerShell (TCP 5985/5986) · unlock with TL Creds
• 🔒 TL-2026-5820 PowerShell-Driven Silent MSI Install from Azure Blob Storage (Teams Helpdesk Loader) · unlock with TL Creds
• 🔒 TL-2026-5820 Rundll32 Loading Second-Stage DLL via 'open' Export from User-Writable Path · unlock with TL Creds
• 🔒 TL-2026-5820 Teams Helpdesk Follow-On Artifacts: [indicator] Infostealer, [indicator] Keylogger, [indicator], [indicator] · unlock with TL Creds
• 🔒 TL-2026-5820 EdgeUpdate Run Key / Startup Shortcut and Portable Node.js Implant Persistence · unlock with TL Creds
• 🔒 TL-2026-5820 Implant C2 and Payload Staging: Known IOC Domains and Node/Java Egress to cloudapp.azure.com · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-5820.

Sample indicators (3 of 30)

• Domain: update1n5[.]blob[.]core[.]windows[.]net
• File hash: 4cfdcae6dd1d6d98b870c8f0654d504f2bf10479a117dc297de789c249dc389d
• Domain: update1n6[.]blob[.]core[.]windows[.]net

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

Technical analysis

Microsoft Teams allows external-tenant one-on-one chats and calls by default. Attackers exploit this by creating throwaway Entra ID tenants (typically with default .onmicrosoft.com domains), using free Outlook.com accounts, or using compromised accounts at other organizations, and then impersonating an 'IT Support' or 'Help Desk Manager' persona. Display names often include admin-style keywords, non-ASCII characters such as emojis, or extra spaces that push the '(External)' label out of view. Many intrusions begin with email bombing: the victim's mailbox is flooded (InfoGuard observed over 2,000 newsletter sign-up emails) so that an offer of help from 'IT' appears credible.

Once contact is established by chat, voice call or meeting, the operator asks the victim to share their screen, approve a remote-control request, or open Quick Assist and read back a code. Other remote tools named across sources include AnyDesk, DWAgent and ScreenConnect. Files are delivered as SharePoint-hosted links that can appear as chat attachments (Hunters demonstrated injecting attachments into one-on-one chats with Burp Suite), via Bit.ly links redirecting to compromised SharePoint pages, or via phishing pages impersonating a Quick Assist authentication prompt. Hunters notes warning banners can disappear once a victim answers an instant meeting call, and that Teams provides no dedicated log for voice calls or screen sharing.

Observed follow-on activity differs by incident. Microsoft (2026-09-02) documents PowerShell downloading a malicious MSI from Azure Blob Storage, installed silently with msiexec /qn, which stages a portable Node.js runtime and an encrypted JavaScript implant (SynkLoader, EtherRatz, FakeAll families), with HTTPS long-polling C2, persistence through an 'EdgeUpdate' Run key or Startup shortcut, AD discovery, screenshot exfiltration and WinRM lateral movement to servers, domain controllers and certificate authorities. CyberProof (incident 2025-11-04/05) saw a fake Quick Assist credential page lead to a Python-compiled infostealer (updater.exe) and discovery commands. InfoGuard (2025) saw Quick Assist, an attempted ScreenConnect install, theft of a VPN profile, a keylogger (SecureSensor.exe) and post-call brute forcing of the Office 365 account. The earlier VEILDrive campaign (Hunters, Nov 2024) used the same Teams impersonation and Quick Assist vector against a U.S. critical infrastructure organization, delivering LiteManager and Java malware (Cliento.jar) with OneDrive/Microsoft Graph C2; Team AXON assessed a significant probability of Russian origin. No single actor is attributed to the generic technique; ransomware was not observed in the Microsoft campaign, though the activity is consistent with pre-ransomware behavior.

Detection guidance from Hunters centers on O365 audit events ChatCreated (HasForeignTenantUsers, OneOnOne), MessageSent (MessageURLs, sender IP), UserAccepted, MemberAdded, TeamsImpersonationDetected and TIMailData email spikes preceding the chat.

MITRE ATT&CK techniques by tactic:

Discovery

T1018 Remote System Discovery; T1082 System Information Discovery; T1087.002 Domain Account; T1518.001 Security Software Discovery

Lateral Movement

T1021.006 Windows Remote Management

Defense Evasion

T1036 Masquerading; T1218.007 Msiexec; T1218.011 Rundll32; T1497.001 System Checks

Execution

T1059.001 PowerShell; T1059.007 JavaScript; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1219 Remote Access Tools

Credential Access

T1110 Brute Force

Collection

T1113 Screen Capture

Persistence

T1547.001 Registry Run Keys / Startup Folder

Initial Access

T1566.003 Spearphishing via Service

Resource Development

T1585.003 Cloud Accounts; T1586.003 Cloud Accounts

Reconnaissance

T1598.004 Spearphishing Voice

Remediation

Patches

• No CVE; Hunters reports Microsoft patched a mention-notification warning-banner bypass during their research

Immediate actions

• Restrict Teams external access to an allowlist of trusted domains instead of allowing all external tenants
• Block or tightly control Quick Assist and unapproved RMM tools (AnyDesk, DWAgent, ScreenConnect)
• Alert on email-volume spikes (TIMailData) followed by an external OneOnOne ChatCreated event
• Keep 'give or request control' disabled for external participants
• If compromise is suspected, isolate the host and rotate credentials reachable from it, including domain admin accounts for domain-joined hosts

Workarounds

• Disable B2B invites to add external users: Set-CsTeamsMessagingPolicy -UseB2BInvitesToAddExternalUsers $false
• Disable external access in the Teams admin center if not required for business

Longer-term hardening

• Enable Unified Audit Logging in every Microsoft 365 tenant and ingest Teams events
• Enforce phishing-resistant MFA and compliant-device Conditional Access
• Restrict WinRM (TCP 5985) to authorized management workstations
• Train users to verify IT/help desk contacts through known channels
• Enable ASR rules, network protection and cloud-delivered protection

Affected and fixed versions

• Microsoft — Microsoft Teams (external access / chat with anyone enabled)
  Vulnerable versions: Tenants with default external communication settings
  Fixed in: Tenants restricting external access to allowlisted domains
• Microsoft — Quick Assist
  Vulnerable versions: Where unrestricted
  Fixed in: Where blocked or limited to approved use

Timeline

• 2024-08-01 VEILDrive campaign likely begins (early August 2024 per Hunters); Teams messages impersonating IT used to prompt Quick Assist sessions at a U.S. critical infrastructure organization. Date is approximate.
• 2025-09-01 InfoGuard CSIRT publishes analysis of a fake-support Teams attack: 2,000+ bombing emails, 'Help Desk Manager' caller, Quick Assist, attempted ScreenConnect install, VPN profile theft.
• 2025-11-04 CyberProof-observed incident: external user contacts a victim via Teams 'Chat with Anyone' posing as IT support.
• 2025-11-05 Attacker starts a Teams call and sends a fake Quick Assist authentication URL; infostealer locked-ioc-22 downloaded; MDR isolates the host after discovery commands.
• 2025-12-02 CyberProof publishes its write-up of the Teams/Quick Assist credential-theft incident.
• 2026-09-02 Microsoft Security publishes analysis of a human-operated campaign abusing Teams external collaboration, delivering SynkLoader/EtherRatz/FakeAll via MSI and Node.js, with WinRM lateral movement.

Sources cited

• Impersonating IT support: Threat actors turn remote session into enterprise-wide access (Microsoft Security) Microsoft · Vendor report · 2026-09-02
• CSIRT warns: New wave of cyberattacks via Teams fake support (InfoGuard) infoguard.ch · Research · 2025-09-01
• Leveraging Microsoft Teams for Initial Access posts.inthecyber.com · Research
• Microsoft Learn: Teams meeting policies - content sharing Microsoft · Vendor report
• Detecting Microsoft Teams Phishing: Hunting the Fake IT Helpdesk Threat (Hunters Team AXON) hunters.security · Blog
• VEILDrive: Threat Actors Exploit Microsoft Services for Malware C2 (Hunters Team AXON) hunters.security · Blog
• Teams social engineering attack: threat actors impersonate IT to steal credentials via Quick Assist (CyberProof) cyberproof.com · Blog · 2025-12-02

More in phishing

• 2026 FIFA World Cup Scam Wave: 35,000+ Fake Ticket, Shop and Streaming Sites
• Utility Impostor Scams: Lookalike Domains, Scam Ads and Phishing-as-a-Service (Darcula V3) Targeting Utility Customers
• 110-Domain Fake Copyright-Strike (DMCA/YouTube) Phishing Estate Using Browser-in-the-Browser Google Credential Harvesting
• SkyW4lker-Associated Microsoft OAuth Phishing via Adobe-Hosted PDF Lure (slybee.com)
• Holiday Phishing Scams 2026: Black Friday-Themed Phishing, Quishing, Callback Fraud and BEC Targeting Employees