Reported by 4 outlets

Timeline

1. original reporting

   Microsoft Teams Help Desk Impersonation: When IT Support Messages You First

   scamdrill.com · 25d ago · September 18th, 2026

   Attackers are opening Microsoft Teams chats from tenants they control, using a display name like IT Service Desk , and talking people into either installing a file or handing over a remote session. Teams allows chat from any external domain by default, and the attacker only needs the target to say yes once. In the case Expel documented, the yes was an MSI hosted on a Microsoft Azure storage endpoint; the payoff was a fake Windows lock screen that captured the user’s password in the clear. Two settings in the Teams admin center and one sentence said out loud to your staff close most of this. submitted by /u/scamdrill [link] [comments]

   via reddit r/cybersecurity: Microsoft Teams Help Desk Impersonation: When IT Support Messages You First

2. update from cyberpress.org

   Microsoft Teams Vishing Campaign Targets 150+ Employees With RMM and NTLM Relay Attacks

   cyberpress.org · 42d ago · September 1st, 2026

   A coordinated social engineering campaign has targeted more than 150 employees across at least 10 organizations by abusing Microsoft Teams to impersonate internal IT support staff. Tracked as Spring Ring, the campaign was active between January and April 2026 and combined voice phishing, remote monitoring and management (RMM) tools, custom malware, and NTLM relay techniques. The attackers first created external Microsoft Teams accounts using professional-looking names such as “Help Desk,” “IT Assistance,” and “Network Support.” Many accounts used attacker-controlled .onmicrosoft.com tenants designed to make the identities appear connected to legitimate corporate infrastructure. After initiating a chat, the attackers called victims and posed as IT technicians. The voice interaction was central to the attack. Rather than relying only on malicious links, the threat actors used real-time conversations to build trust and persuade employees to perform actions on their computers. Some calls lasted 10 to 15 minutes, while others were short or resulted in voicemails. Teams Vishing Targets Employees In Campaign A , attackers convinced victims to launch legitimate remote-support software such as Quick Assist or third-party RMM tools. After obtaining remote access, they performed basic reconnaissance using commands including whoami /groups and net group /dom . The attackers then used PowerShell to download an obfuscated remote access Trojan from the attacker-controlled domain san-sid[.]c

3. update from gbhackers.com

   Hackers Pose as IT Support on Microsoft Teams to Target More Than 150 Employees

   gbhackers.com · 42d ago · September 1st, 2026

   The operation demonstrates how attackers are shifting phishing activity from email into trusted collaboration platforms, using live voice calls to […] The post Hackers Pose as IT Support on Microsoft Teams to Target More Than 150 Employees appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

4. update from cyberpress.org

   Hackers Pose as IT Support on Microsoft Teams to Target More Than 150 Employees

   cyberpress.org · 40d ago · September 3rd, 2026

   The attackers did not exploit a flaw in Microsoft Teams . Instead, they abused the trust employees place in workplace communication tools. The operation shows how attackers are shifting beyond traditional phishing emails. Rather than sending a malicious link and waiting for a victim to click it, Spring Ring operators spoke directly with employees and persuaded them to run software or download files. Teams Scammers Hit 150 The attackers used external Microsoft 365 tenants with deceptive .onmicrosoft.com addresses designed to look like internal corporate services. Examples included names containing words such as “internal,” “network,” “infrastructure,” “certified,” and “helpdesk.” After sending a Teams chat request, the threat actors quickly launched an unsolicited audio call. This voice-phishing technique, also known as vishing , gave the attackers a more convincing way to pose as company IT personnel. External chat created, Delete/Accept screen (Source: unit42) Many calls lasted only a few seconds or went una

5. mentioned by gbhackers.com

   Spring Ring Campaign Uses Teams Vishing, PowerShell RAT and NTLM Relay Attacks

   gbhackers.com · 40d ago · September 3rd, 2026

6. update from thehackernews.com

   Why are these so successful you say? Because almost all of these people in these roles are boomers +, the targeted age range. Fake IT Calls

   thehackernews.com · 35d ago · September 8th, 2026

   Why are these so successful you say? Because almost all of these people in these roles are boomers +, the targeted age range. Fake IT Calls

   via Mastodon https://thehackernews.com/2026/09/microsoft-365-attackers-use-help-desk.html

7. update from cyberpress.org

   Microsoft Teams Help Desk Impersonation Attack Steals Windows Passwords With Fake Lock Screen

   cyberpress.org · 22d ago · September 21st, 2026

   The campaign, detailed by Expel researchers in an August analysis of a malware family dubbed SynkLoader , begins with a Teams message from an attacker-controlled Microsoft 365 tenant. The sender may appear as an external .onmicrosoft.com account, yet Teams and a plausible support pretext can make it appear legitimate. Hosting the payload on Microsoft infrastructure may help reduce suspicion, but it deploys a multi-language loader that uses Python, PowerShell, C#, and C++ components. Scamdrill said the malware executes modules in memory and establishes persistence via random scheduled tasks at logon and 10 a.m. daily. PhishLocker impersonates the Windows lock screen. It retrieves the active user name and the system’s actual lock-screen wallpaper, then displays a full-screen password prompt. The prompt reportedly does not validate credentials, meaning an arbitrary entry can dismiss the f

8. update from gbhackers.com

   Hackers Abuse Microsoft Teams to Pose as IT Support and Steal Employee Passwords

   gbhackers.com · 22d ago · September 21st, 2026

   These attacks exploit a simple vulnerability: employees tend to distrust suspicious emails but often do not apply the same caution to collaboration platforms like Teams.