Attackers Abuse Microsoft Teams and Quick Assist in New Helpdesk Impersonation Attack Chain

Cybersecuritynews •Tushar Subhra Dutta • April 20, 2026

A new and deceptive attack campaign has emerged where threat actors are impersonating IT helpdesk personnel through Microsoft Teams to trick employees into granting remote access to their systems. What makes this campaign dangerous is how it uses trusted, everyday business tools to sidestep user suspicion and quietly infiltrate enterprise networks without triggering traditional security […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Teams Exploited for Helpdesk Impersonation Attacks Cyber attackers are increasingly using Microsoft Teams to impersonate IT helpdesk staff, employing social engineering tactics to gain remote access to enterprise systems. This method, known as 'cross-tenant helpdesk impersonation,' allows attackers to initiate conversations with employees and convince them to grant access, bypassing traditional phishing defenses. Microsoft has documented a nine-stage attack chain that begins with external Teams chats, leading to the use of legitimate tools like Quick Assist for remote control and data exfiltration. The attackers blend their activities with normal IT operations, making detection challenging. This technique has been observed in multiple incidents, emphasizing the growing risk associated with collaboration platforms. Organizations are urged to treat external Teams contacts as untrusted to mitigate these risks. 51 sources 68

Extracted Entities

Attackers Abuse Microsoft Teams and Quick Assist in New Helpdesk Impersonation Attack Chain

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Tools (2)