![[-]](https://www.aiowares.com/images/collapse.png "[-]")
04-20-2026, 03:47 PM
Microsoft is warning that attackers are now using Microsoft Teams to pose as IT/helpdesk staff and trick employees into giving remote access.
The scam usually starts with an external Teams message about an "account issue" or "security fix", then pushes the user to open a remote session of some kind.
Once inside, they use legit tools like PowerShell and Windows Remote Management to move around the network, making it hard to spot anything suspicious. Data is then quietly collected and exfiltrated using tools like Rclone.
The tricky part is how normal everything looks this blends right into everyday IT activity.
Microsoft's advice is: treat external Teams messages with caution, especially if someone asks for remote access.
Has anyone here seen suspicious external Teams messages or unusual "IT support" requests lately?
The scam usually starts with an external Teams message about an "account issue" or "security fix", then pushes the user to open a remote session of some kind.
Once inside, they use legit tools like PowerShell and Windows Remote Management to move around the network, making it hard to spot anything suspicious. Data is then quietly collected and exfiltrated using tools like Rclone.
The tricky part is how normal everything looks this blends right into everyday IT activity.
Microsoft's advice is: treat external Teams messages with caution, especially if someone asks for remote access.
Has anyone here seen suspicious external Teams messages or unusual "IT support" requests lately?
