Cybercriminals Use Microsoft Teams to Masquerade as IT Support and Hijack Windows PCs

Security researchers have identified a new social‑engineering campaign in which attackers pose as corporate IT technicians on Microsoft Teams, coaxing employees into handing over remote control of their Windows computers.

The scheme typically begins with a unsolicited Teams chat or call from someone claiming to be from the organization’s help desk. The impostor asks the target to share their screen or to install a remote‑desktop utility, presenting the request as a routine troubleshooting step. Once the victim grants access, the intruder can silently install malware, capture credentials, or move laterally across the network.

The tactic exploits the widespread adoption of Teams as a primary collaboration tool, especially since the shift to remote and hybrid work arrangements. Because many workers are accustomed to receiving legitimate support through the platform, the fake assistance request often appears credible, and the language used mirrors standard internal support scripts.

Experts say the success of the ploy rests on a combination of trusted branding and the urgency that IT teams commonly convey. By leveraging a familiar interface, attackers lower the psychological barrier that typically prevents users from clicking unknown links or downloading software from strangers.

Once attackers gain a foothold, they can deploy a range of malicious payloads, from data‑stealing tools to ransomware. The remote access also enables them to monitor ongoing activity, capture authentication tokens, and potentially compromise additional systems within the organization.

Security professionals advise employees to verify any support request through an independent channel—such as a known phone number or official ticketing system—before granting remote access. Organizations should enforce multi‑factor authentication, restrict the use of remote‑desktop tools to approved personnel, and conduct regular awareness training that highlights the signs of impersonation scams.

Microsoft has issued guidance urging users to be cautious of unsolicited support offers on Teams and to enable built‑in safety features that flag unknown participants. The company is also reviewing its platform controls to make it harder for threat actors to masquerade as internal staff.

Analysts expect that as collaboration tools become more entrenched in daily workflows, similar impersonation attacks will continue to evolve. Maintaining a skeptical stance toward unexpected assistance requests and reinforcing clear support procedures remain essential defenses against this emerging threat.