A Teams message from ‘the help desk’, followed by a call: something is wrong with your mailbox, may we take a quick look? It sounds helpful, but it is one of the most effective ways attackers are getting in at the moment. At the end of October Microsoft described two intrusions it investigated that started in exactly this way, and The Hacker News summarised the attack chain.
What happened
The attackers set up their own Microsoft 365 environment with a name resembling a support department. From that outside organisation they sent employees a chat and called them through Teams. The request was always the same: open Quick Assist and read out the code. Anyone who does so hands the caller full control of their computer.
Things moved quickly after that. Software was placed in a folder named to look like a Windows update and then launched. The attackers went on to abuse weakly configured certificate services on the network (Active Directory Certificate Services) to pose as administrators. In one case they copied company data to their own server. Microsoft points out that there is no patch for this: it is about deception and configuration, not a software flaw. Nor is the method new; Microsoft warned about it in April as well.
What this means for your organisation
By default, Teams is open to chats and calls with other organisations. That is useful for working with customers and suppliers, but it also means a stranger with a convincing name can reach your staff directly. In a small or medium-sized business, where people trust each other and their IT partner, such a message stands out less than a suspicious email.
So the risk is not only technical. An employee who wants to be helpful can open the door with a single code. A combination of clear agreements and a few settings works best.
What you can do
- Agree how IT gets in touch. Make sure everyone knows your IT partner will never ask, unprompted, to take over a screen through an external Teams chat. In doubt? Hang up and call back on the number you know.
- Limit external access in Teams. Only allow chats with organisations you actually work with, or block unknown external accounts.
- Choose one support tool. If your IT partner uses its own remote support tool, switch Quick Assist off.
- Have your certificate services reviewed. If you run your own Windows domain, have the certificate settings checked to make sure they are not too permissive.
How Qteco helps
For our managed clients we configure external access in Teams deliberately and keep track of which remote support tools are allowed. We also review how the domain and certificate services are set up, and help employees with short, practical awareness sessions about requests like these. That way everyone knows what genuine contact with the help desk looks like.
Would you like to know where your Teams environment stands today? Book a conversation with one of our engineers.
Sources
- Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data — The Hacker News (2026-11-02)
- From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths — Microsoft (2026-10-30)
Read also
Critical PHP flaws: have your website updated today
Ready to run worry-free?
Book a no-obligation introduction. We map your IT and security and show where the difference lies.
Book a call →