A fake IT help desk scam is when someone contacts your staff by phone, email or Microsoft Teams, pretends to be IT support, and talks them into starting a remote-control session on their computer. The fix is a rule your staff can follow: never let anyone take control of your computer unless you called them.
How does a fake IT help desk scam work?
It starts with pressure, then offers relief. Arctic Wolf documented more than 400 incidents of attackers abusing the external chat feature in Microsoft Teams. They flood an employee’s inbox with hundreds of newsletter and subscription emails. Minutes later, a “help desk” contacts the victim on Teams offering to fix the problem (Arctic Wolf research, reported by Help Net Security, 27 October 2026).
The fake technician then moves to a Teams voice call and asks the person to start Quick Assist, the remote-access tool built into Windows. The victim only has to read out a six-digit code. Arctic Wolf says attackers often contact several people within about five minutes, and malicious code can start running in under 15 minutes.
The Teams chat is not a Teams vulnerability. Outside users in other Microsoft 365 tenants can message your staff because external access is on by default (Arctic Wolf, 27 October 2026).
Is it only Teams?
No. Cisco Talos Incident Response reported attackers posing as help desk staff by phone, email and Teams during the third quarter of 2026, persuading people to open remote access sessions. Talos says the targets were not only senior or technical staff, and the attackers were “primarily seeking any susceptible user for initial access” (Cisco Talos, reported by Help Net Security, 30 October 2026).
In one case a phone call led to a Quick Assist session and then a ransomware attack. In another, the victim rang a fake support number shown in a browser pop-up. The caller does not need to know your company. A confident voice and a plausible problem are enough.
Why does it work so often?
Because the attacker has done the hard part for you: they made you want help. Hundreds of unwanted emails is a real problem, and a polite person offering to fix it feels like relief.
Moving the conversation to Teams helps too. Arctic Wolf notes the move into Teams helps the lure past the suspicion people usually apply to email (Arctic Wolf, 27 October 2026). A chat message from “IT” inside a work tool feels internal, even when it comes from outside.
Microsoft first described this technique in mid-2024 in attacks linked to the Black Basta ransomware group, and Arctic Wolf says it has since appeared in other ransomware operations. This is not a new trick. It is a proven one that keeps working.
What are the warning signs?
Five signs, any one of which is enough to stop and check.
- You did not ask for help. Real IT support responds to a request or a problem you already know about.
- A sudden flood of spam or confirmation emails, followed soon after by someone offering to fix it.
- An unfamiliar name in Teams. Arctic Wolf saw names such as “helpdeskteam365”, often with “(Internal)” added to look like a colleague (Arctic Wolf, 27 October 2026).
- A request to read out a code, install a tool or open Quick Assist.
- Urgency. Fixing it “before it spreads” is how people are rushed past their own doubts.
What should a business do about it?
Do five things, two for your staff and three for your IT settings.
- Give staff one rule. If IT contacts you out of the blue, hang up, and call back on a number you already hold. A genuine IT provider will not mind.
- Tell staff where to report. A named person or one email address, and no blame for the person who clicked.
- Restrict external Teams chat. Arctic Wolf advises allowing it only with named partner domains and blocking unmanaged accounts (Arctic Wolf, 27 October 2026).
- Limit remote-access tools. Arctic Wolf advises restricting Quick Assist and similar tools to authorised IT staff only (Arctic Wolf, 27 October 2026).
- Protect the sign-in. Talos recommends phishing-resistant multi-factor authentication such as hardware security keys, and help desk verification before anyone can add a new sign-in method (Cisco Talos, 30 October 2026). Our post on multi-factor authentication explains why a prompt alone is not enough.
The last three are settings, not training. They take effect for every user at once, which is why they are worth doing even if your staff are sharp.
What if someone has already let them in?
Act within minutes, not hours. Disconnect the computer from the network, and tell your IT provider straight away so they can check the account and look for anything installed during the session.
Change the person’s password from a different, clean device. Do not just uninstall the remote tool and carry on, because in one case Talos describes, remote management software already on the network was then used to install further tools. Talos also notes that attackers can disable security software, so the quicker the report, the better the odds.
Make clear that the person is not in trouble. In these attacks the victim has usually been targeted by someone who does this for a living, and the fastest reports come from staff who are not afraid to make one.
Who can check these settings for a business in Surrey?
Your IT provider can review Teams and Microsoft 365 settings and the tools allowed on each computer. INDIGO IT, a managed IT support and cyber security provider in Camberley, Surrey, manages Microsoft 365 and cloud services for businesses as part of its managed IT support.
If you would like those settings checked, speak to Matt. If you want to start now, send your team the one-line rule above today and ask your IT provider whether external Teams chat is switched on.
Frequently asked questions
What is a fake IT help desk scam?
An attacker pretends to be IT support, by phone, email or Microsoft Teams, and persuades an employee to start a remote-control session on their computer. Once connected, they can install malware, steal data or prepare ransomware.
How do I know if an IT help desk call is real?
Hang up and call back on a number you already hold, such as the one in your IT provider’s contract. Be suspicious of any contact you did not ask for, especially one that asks for a code or the installation of a remote-access tool.
Can someone message my staff on Microsoft Teams from outside the company?
Yes, if external access is enabled, and it is on by default in Microsoft 365. Most businesses only need to chat with a few named partners, so it can usually be limited to those specific domains.
What is Quick Assist and should staff be able to use it?
Quick Assist is a remote-access tool built into Windows. Most staff do not need it, and attackers favour it because it is already installed. Restrict it to authorised IT staff.
