Fake Helpdesk Attack Uses Teams and Quick Assist to Breach Targets

Gbhackers •Mayura Kathir • April 20, 2026

Attackers are increasingly abusing Microsoft Teams and Windows Quick Assist to run a helpdesk‑themed social engineering attack chain that leads to full enterprise compromise and stealthy data theft. By impersonating IT support and relying on legitimate tools and protocols, adversaries can move laterally and exfiltrate data while blending into normal admin activity. Using names such as “Help […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Teams Exploited for Helpdesk Impersonation Attacks Cyber attackers are increasingly using Microsoft Teams to impersonate IT helpdesk staff, employing social engineering tactics to gain remote access to enterprise systems. This method, known as 'cross-tenant helpdesk impersonation,' allows attackers to initiate conversations with employees and convince them to grant access, bypassing traditional phishing defenses. Microsoft has documented a nine-stage attack chain that begins with external Teams chats, leading to the use of legitimate tools like Quick Assist for remote control and data exfiltration. The attackers blend their activities with normal IT operations, making detection challenging. This technique has been observed in multiple incidents, emphasizing the growing risk associated with collaboration platforms. Organizations are urged to treat external Teams contacts as untrusted to mitigate these risks. 51 sources 68

Extracted Entities

Fake Helpdesk Attack Uses Teams and Quick Assist to Breach Targets

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (2)