# Microsoft Teams Phishing via Fake IT Helpdesk Impersonation (External Tenant Social Engineering)

> Threat actors use compromised Teams accounts or newly created Entra ID tenants (often default .onmicrosoft.com domains) to pose as IT/Help Desk, contacting users by chat or voice call, frequently after email bombing. Screen sharing, Quick Assist and other RMM tools, and SharePoint-hosted files are used to gain remote access and deploy loaders or infostealers.

- **Published:** 2026-11-12T04:02:00Z
- **Last reviewed:** 2026-11-12T04:02:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5820
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5820.png
- **ID:** TL-2026-5820
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)

## Description

Microsoft Teams allows external-tenant one-on-one chats and calls by default. Attackers exploit this by creating throwaway Entra ID tenants (typically with default .onmicrosoft.com domains), using free Outlook.com accounts, or using compromised accounts at other organizations, and then impersonating an 'IT Support' or 'Help Desk Manager' persona. Display names often include admin-style keywords, non-ASCII characters such as emojis, or extra spaces that push the '(External)' label out of view. Many intrusions begin with email bombing: the victim's mailbox is flooded (InfoGuard observed over 2,000 newsletter sign-up emails) so that an offer of help from 'IT' appears credible.

Once contact is established by chat, voice call or meeting, the operator asks the victim to share their screen, approve a remote-control request, or open Quick Assist and read back a code. Other remote tools named across sources include AnyDesk, DWAgent and ScreenConnect. Files are delivered as SharePoint-hosted links that can appear as chat attachments (Hunters demonstrated injecting attachments into one-on-one chats with Burp Suite), via Bit.ly links redirecting to compromised SharePoint pages, or via phishing pages impersonating a Quick Assist authentication prompt. Hunters notes warning banners can disappear once a victim answers an instant meeting call, and that Teams provides no dedicated log for voice calls or screen sharing.

Observed follow-on activity differs by incident. Microsoft (2026-09-02) documents PowerShell downloading a malicious MSI from Azure Blob Storage, installed silently with msiexec /qn, which stages a portable Node.js runtime and an encrypted JavaScript implant (SynkLoader, EtherRatz, FakeAll families), with HTTPS long-polling C2, persistence through an 'EdgeUpdate' Run key or Startup shortcut, AD discovery, screenshot exfiltration and WinRM lateral movement to servers, domain controllers and certificate authorities. CyberProof (incident 2025-11-04/05) saw a fake Quick Assist credential page lead to a Python-compiled infostealer (updater.exe) and discovery commands. InfoGuard (2025) saw Quick Assist, an attempted ScreenConnect install, theft of a VPN profile, a keylogger (SecureSensor.exe) and post-call brute forcing of the Office 365 account. The earlier VEILDrive campaign (Hunters, Nov 2024) used the same Teams impersonation and Quick Assist vector against a U.S. critical infrastructure organization, delivering LiteManager and Java malware (Cliento.jar) with OneDrive/Microsoft Graph C2; Team AXON assessed a significant probability of Russian origin. No single actor is attributed to the generic technique; ransomware was not observed in the Microsoft campaign, though the activity is consistent with pre-ransomware behavior.

Detection guidance from Hunters centers on O365 audit events ChatCreated (HasForeignTenantUsers, OneOnOne), MessageSent (MessageURLs, sender IP), UserAccepted, MemberAdded, TeamsImpersonationDetected and TIMailData email spikes preceding the chat.

## MITRE ATT&CK

- T1566.003 Spearphishing via Service
- T1598.004 Spearphishing Voice
- T1585.003 Cloud Accounts
- T1586.003 Cloud Accounts
- T1059.001 PowerShell
- T1059.007 JavaScript
- T1204.002 Malicious File
- T1547.001 Registry Run Keys / Startup Folder
- T1218.007 Msiexec
- T1218.011 Rundll32
- T1036 Masquerading
- T1497.001 System Checks
- T1110 Brute Force
- T1082 System Information Discovery
- T1087.002 Domain Account
- T1018 Remote System Discovery
- T1518.001 Security Software Discovery
- T1021.006 Windows Remote Management
- T1113 Screen Capture
- T1071.001 Web Protocols
- T1219 Remote Access Tools

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5820 Teams External One-on-One Chat from Fake IT Helpdesk / onmicrosoft.com Tenant** (`TL-2026-5820-SPL-001`)

Detects Microsoft Teams audit events (ChatCreated, MessageSent, MemberAdded, UserAccepted, TeamsImpersonationDetected) where a foreign-tenant user opens a one-on-one chat and either uses a default .onmicrosoft.com identity or a helpdesk-style display name (Help Desk Manager, IT Support, Service Desk). This is the initial social-engineering contact used before Quick Assist / RMM sessions (AnyDesk, DWAgent, ScreenConnect) in the fake-IT-helpdesk Teams phishing campaigns and the earlier VEILDrive activity. Maps to T1566.003, T1598.004, T1585.003 and T1586.003.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.003, T1598.004, T1585.003, T1586.003
- **Data sources:** o365:management:activity (Microsoft Teams audit), CloudAppEvents, Microsoft 365 Unified Audit Log
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=o365 sourcetype="o365:management:activity" Workload=MicrosoftTeams earliest=-24h Operation IN ("ChatCreated","MessageSent","MemberAdded","UserAccepted","TeamsImpersonationDetected")
| eval tl_ref="TL-2026-5820"
| eval actor=lower(UserId)
| eval member_names=lower(coalesce(mvjoin('Members{}.DisplayName',"|"),"")." ".coalesce(mvjoin('Members{}.UPN',"|"),""))
| eval helpdesk_name=if(match(member_names,"(help ?desk|it[ _-]?support|service ?desk|it admin|system admin|technical support|it department)"),1,0)
| eval default_tenant=if(match(actor." ".member_names,"onmicrosoft[.]com"),1,0)
| eval foreign=lower(tostring(HasForeignTenantUsers))
| where (foreign="true" AND (isnull(CommunicationType) OR lower(CommunicationType)="oneonone") AND (helpdesk_name=1 OR default_tenant=1)) OR Operation="TeamsImpersonationDetected"
| stats count AS events min(_time) AS first_seen max(_time) AS last_seen values(Operation) AS operations values(ClientIP) AS src_ip dc(ChatThreadId) AS chat_threads max(helpdesk_name) AS helpdesk_name max(default_tenant) AS onmicrosoft_tenant values(tl_ref) AS tl_ref BY actor
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
CloudAppEvents
| where Timestamp > ago(24h)
| where Application == "Microsoft Teams"
| where ActionType in ("ChatCreated", "MessageSent", "MemberAdded", "UserAccepted", "TeamsImpersonationDetected")
| extend Raw = parse_json(RawEventData)
| extend Foreign = tostring(Raw.HasForeignTenantUsers), CommType = tostring(Raw.CommunicationType), MemberText = tolower(tostring(Raw.Members)), Actor = tolower(coalesce(tostring(Raw.UserId), AccountId))
| where ActionType == "TeamsImpersonationDetected"
    or (Foreign =~ "true" and CommType in~ ("OneOnOne", "")
        and (Actor has "onmicrosoft.com" or MemberText has "onmicrosoft.com"
             or MemberText matches regex "(help ?desk|it[ _-]?support|service ?desk|it admin|system admin|technical support|it department)"))
| summarize Events = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Operations = make_set(ActionType), SourceIPs = make_set(IPAddress), Chats = dcount(tostring(Raw.ChatThreadId)) by Actor
| order by LastSeen desc
```

### Sigma

```yaml
title: Teams External Helpdesk Impersonation Chat from Foreign or onmicrosoft.com Tenant (TL-2026-5820)
id: 7c3e5a10-4b2d-4f6e-8a91-0d2c6b7e1a01
status: experimental
description: Detects Microsoft Teams audit events where a foreign-tenant user starts a one-on-one chat using a default onmicrosoft.com identity or a helpdesk-style display name, the initial contact stage of fake IT helpdesk Teams phishing that precedes Quick Assist or RMM sessions.
references:
  - https://www.hunters.security/en/blog/microsoft-teams-phishing-fake-it-helpdesk
  - https://microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access
author: Threadlinqs Team
date: 2026/11/12
tags:
  - attack.initial-access
  - attack.t1566.003
  - attack.reconnaissance
  - attack.t1598.004
  - attack.resource-development
  - attack.t1585.003
  - attack.t1586.003
logsource:
  product: m365
  service: audit
detection:
  selection_base:
    Workload: MicrosoftTeams
    Operation:
      - ChatCreated
      - MessageSent
      - MemberAdded
      - UserAccepted
    HasForeignTenantUsers: 'true'
    CommunicationType: OneOnOne
  selection_actor:
    UserId|contains: 'onmicrosoft.com'
  selection_name:
    Members|contains:
      - 'help desk'
      - 'helpdesk'
      - 'it support'
      - 'service desk'
      - 'it admin'
      - 'system admin'
      - 'technical support'
  selection_impersonation:
    Operation: TeamsImpersonationDetected
  condition: (selection_base and (selection_actor or selection_name)) or selection_impersonation
falsepositives:
  - Legitimate partner or MSP support staff contacting users from a managed onmicrosoft.com tenant
  - Vendor help desks with approved external-access federation
level: high
```

**Known false positives:**

- Approved MSP or vendor support staff chatting from their own onmicrosoft.com tenant
- Partner organisations with federated Teams access whose staff use titles such as IT Support in display names

**Tuning notes:** Allowlist trusted partner tenant domains and known MSP accounts. Correlate with an email-volume spike (TIMailData / mail flow) to the same recipient in the preceding hours to raise fidelity. Community TL_OSINT_Scan matched two medium-confidence Teams-themed campaigns but supplied no corroborated IOCs, so this rule is behaviour-first. Requires Unified Audit Logging and Teams event ingestion.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5820 Quick Assist and Unapproved RMM Tool Execution (AnyDesk, DWAgent, ScreenConnect, LiteManager) (locked: unlock with TL Creds)
- TL-2026-5820 Post-Access Active Directory and Host Discovery Burst from Script or RMM Parent (locked: unlock with TL Creds)
- TL-2026-5820 WinRM Lateral Movement from Implant or Fan-out PowerShell (TCP 5985/5986) (locked: unlock with TL Creds)
- TL-2026-5820 PowerShell-Driven Silent MSI Install from Azure Blob Storage (Teams Helpdesk Loader) (locked: unlock with TL Creds)
- TL-2026-5820 Rundll32 Loading Second-Stage DLL via 'open' Export from User-Writable Path (locked: unlock with TL Creds)
- TL-2026-5820 Teams Helpdesk Follow-On Artifacts: [indicator] Infostealer, [indicator] Keylogger, [indicator], [indicator] (locked: unlock with TL Creds)
- TL-2026-5820 EdgeUpdate Run Key / Startup Shortcut and Portable Node.js Implant Persistence (locked: unlock with TL Creds)
- TL-2026-5820 Implant C2 and Payload Staging: Known IOC Domains and Node/Java Egress to cloudapp.azure.com (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- Domain: `update1n5[.]blob[.]core[.]windows[.]net`
- File hash: `4cfdcae6dd1d6d98b870c8f0654d504f2bf10479a117dc297de789c249dc389d`
- Domain: `update1n6[.]blob[.]core[.]windows[.]net`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Detecting Microsoft Teams Phishing: Hunting the Fake IT Helpdesk Threat (Hunters Team AXON)](https://www.hunters.security/en/blog/microsoft-teams-phishing-fake-it-helpdesk)
- [VEILDrive: Threat Actors Exploit Microsoft Services for Malware C2 (Hunters Team AXON)](https://www.hunters.security/en/blog/veildrive-microsoft-services-malware-c2)
- [Impersonating IT support: Threat actors turn remote session into enterprise-wide access (Microsoft Security)](https://microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access)
- [CSIRT warns: New wave of cyberattacks via Teams fake support (InfoGuard)](https://www.infoguard.ch/en/blog/csirt-analyzes-fake-support-anttack-via-teams)
- [Teams social engineering attack: threat actors impersonate IT to steal credentials via Quick Assist (CyberProof)](https://www.cyberproof.com/blog/teams-social-engineering-attack-threat-actors-impersonate-it-to-steal-credentials-via-quick-assist/)
- [Leveraging Microsoft Teams for Initial Access](https://posts.inthecyber.com/leveraging-microsoft-teams-for-initial-access-42beb07f12c4)
- [Microsoft Learn: Teams meeting policies - content sharing](https://learn.microsoft.com/en-us/microsoftteams/meeting-policies-content-sharing)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5820