UNC6692 Impersonates IT Helpdesk via Microsoft Teams to Deploy SNOW Malware

Back Thehackernews

UNC6692 Impersonates IT Helpdesk via Microsoft Teams to Deploy SNOW Malware

Thehackernews •[email protected] (The Hacker News) • April 23, 2026

Share: View original

Learn how to stop patient zero attacks before they bypass detection and compromise your systems at entry points.

Learn how to validate real attack paths and reduce exploitable risk with continuous agentic security validation.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Teams Exploited for Helpdesk Impersonation Attacks Cyber attackers are increasingly using Microsoft Teams to impersonate IT helpdesk staff, employing social engineering tactics to gain remote access to enterprise systems. This method, known as 'cross-tenant helpdesk impersonation,' allows attackers to initiate conversations with employees and convince them to grant access, bypassing traditional phishing defenses. Microsoft has documented a nine-stage attack chain that begins with external Teams chats, leading to the use of legitimate tools like Quick Assist for remote control and data exfiltration. The attackers blend their activities with normal IT operations, making detection challenging. This technique has been observed in multiple incidents, emphasizing the growing risk associated with collaboration platforms. Organizations are urged to treat external Teams contacts as untrusted to mitigate these risks. 42 sources 68

Extracted Entities

Attack Types (2)

Malware Phishing

Malware (1)

MITRE ATT&CK (1)

T1566 - Phishing

Tools (1)

Microsoft Teams