Microsoft Teams has become one of the most trusted communication platforms in modern organizations. That trust is now being actively exploited.
Recent research from CyberProof and others has uncovered a sophisticated social engineering campaign where threat actors impersonate internal IT staff over Microsoft Teams and trick users into granting remote access using Windows Quick Assist. Once access is granted, attackers can steal credentials, deploy malware, and move deeper into the environment without ever exploiting a traditional vulnerability.
This campaign highlights a broader trend in cyber attacks: abusing legitimate tools and human trust rather than relying on malware alone.
How the Attack Works
At the center of this campaign is Microsoft Teams’ newer “Chat with Anyone” capability. This feature allows Teams users to receive direct messages from external email addresses, even if those users are not part of the organization’s tenant. Threat actors are using this feature to pose as internal IT support and initiate contact with employees.
The attack typically unfolds in several stages:
Step 1: External IT Impersonation
Attackers initiate a Teams chat or call using an external account but configure the display name to appear as something like “IT Support” or “Help Desk.” Because the message arrives through Teams, users often assume it is legitimate and internal, especially when the attacker claims to be responding to an urgent issue.
Step 2: Social Engineering and Urgency
The attacker creates pressure by claiming there is a security problem, account issue, or abnormal activity. In some cases, victims are first overwhelmed with spam emails, making the follow up “IT” message seem plausible and timely.
This step relies entirely on social engineering rather than technical exploitation.
Step 3: Abuse of Quick Assist
The attacker then instructs the user to launch Windows Quick Assist, a legitimate Microsoft remote support tool that is installed by default on Windows 11 systems. Users may also be sent a phishing link that mimics a Quick Assist download or login page, prompting them to enter Microsoft credentials.
Once Quick Assist access is granted, the attacker gains remote control of the device.
Step 4: Credential Theft and Malware Deployment
After remote access is established, attackers have been observed performing reconnaissance, dumping credentials, and deploying malware such as Python compiled infostealers or .NET based loaders disguised as updater utilities.
These actions closely resemble techniques used by human operated ransomware groups like Black Basta, which Microsoft and multiple security vendors have linked to Quick Assist abuse since 2024.
Why This Attack Is So Effective
What makes this campaign particularly dangerous is that it uses trusted, signed, and built in tools.
Quick Assist is a Microsoft owned application. Microsoft Teams is already approved and widely used. Because no exploit or obvious malware is required in the early stages, many traditional security controls do not raise alerts until the attacker is already active on the endpoint.
In short, the attacker does not break in. They are invited in.
Broader Industry Context
This is not an isolated incident. Multiple security firms, including KnowBe4, Bitdefender, BlueVoyant, and SpiderLabs, have reported similar campaigns abusing Teams calls, chat impersonation, and Quick Assist to gain initial access.
Microsoft has also publicly acknowledged that financially motivated groups are increasingly using Teams as an initial access vector, particularly for ransomware related activity.
As collaboration platforms continue to replace email for internal communication, attackers are shifting their focus accordingly.
How Organizations Can Reduce Risk
Defending against this type of attack requires a mix of technical controls and user awareness.
Restrict External Teams Messaging
Organizations should review Teams messaging policies and consider disabling or tightly restricting “Chat with Anyone” and unsolicited external one to one chats. Microsoft provides policy controls that can block guest invitations from unmanaged email addresses.
Limit or Disable Quick Assist
If Quick Assist is not required in your environment, it should be blocked or removed. If it is required, its use should be restricted to approved support workflows and monitored closely.
Enforce Strong Identity Controls
Multi factor authentication, conditional access, and device trust policies significantly reduce the impact of credential theft. Even if a user is socially engineered, these controls can prevent attackers from reusing stolen credentials.
Train Users Beyond Email Phishing
Security awareness training must extend beyond email. Users should be taught that IT will never initiate unsolicited Teams chats or calls asking for remote access or credentials. This expectation should be clearly documented and reinforced.
Final Thoughts
This campaign is a clear reminder that security is no longer just about patching software. Attackers are exploiting the way people work and the tools they trust most.
Microsoft Teams and Quick Assist are not insecure by default, but without proper controls and user education, they can become powerful entry points for attackers. As collaboration platforms continue to evolve, security strategies must evolve with them.
