Microsoft is warning that attackers are now using Microsoft Teams to pose as IT/helpdesk staff and trick employees into giving remote access.
The scam usually starts with an external Teams message about an "account issue" or "security fix", then pushes the user to open a remote session of some kind.
Once inside, they use legit tools like PowerShell and Windows Remote Management to move around the network, making it hard to spot anything suspicious. Data is then quietly collected and exfiltrate