You’re working, and a Teams message pops up. Someone called “IT Support (Internal)” says they’ve noticed a problem with your account and wants to help fix it. Is that real?
If you didn’t ask for help and don’t know the person, treat it as a scam until you’ve proven otherwise. Security researchers have been seeing this exact pattern over and over, and it ends with someone getting control of a computer. Arctic Wolf Labs, in a report covered by The Hacker News on October 26, 2026, described a “recurring social engineering pattern” across hundreds of cases.
What’s actually happening
Teams lets people from outside your organization start a chat with you. Attackers use that feature. They set up their own Microsoft 365 accounts, give them names that sound like a help desk, and message people at the target company.
The names are boring on purpose. Arctic Wolf listed examples such as “Help Desk,” “IT Service Desk,” “HelpDesk Manager” and “IT Support – Christopher Thomas.” Some include the word “Internal” in brackets. Newer versions add the target company’s name to look more believable. Teams normally warns you when a message comes from an outside user, and these names are designed to get around that warning.
Often the scam starts before the Teams message. The researchers describe “mail bombing”: your inbox suddenly fills with hundreds of newsletter or subscription confirmations in a short time. You’re stressed, your email is unusable, and then a friendly “IT person” shows up offering to fix it. The flood is there to create urgency.
Once you’re talking, the goal is remote access. The report says attackers use real remote support tools, the kind legitimate IT people use. It names Quick Assist, AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport and LogMeIn. Because these are legitimate programs, installing one doesn’t look suspicious to you. Some attackers also use a phone call to walk the victim through it.
After that, according to the report, the attacker looks around the network, installs a backdoor and more remote tools, moves toward the systems that control the network, and steals data before deploying ransomware. Sophos linked related activity to Chaos ransomware. In one case, the attacker had the user run a PowerShell command that downloaded and launched an installer.
One detail worth knowing: the attackers generally avoid pasting a link into Teams, because Microsoft’s link scanning could catch it. They have you open the file yourself during the remote session instead. So “there was no suspicious link” is not proof the conversation was safe.
Arctic Wolf’s summary is blunt: this works because it “exploits trust rather than a software vulnerability.” There’s nothing to patch. The weak point is a person deciding whether to believe a message.
How to tell if this could hit you
The attacks, per the report, go after organizations where external access in Teams is turned on. If you use Microsoft 365 with Teams, that’s worth finding out. Ask whoever manages your Microsoft 365 whether outside people can message your staff, and whether you actually need that.
If you’re self-employed or run a small shop with no IT department, here’s a simple point: there may be no “internal IT” at all. In that case any unexpected message from “IT” is suspicious by default.
The three checks before anyone gets remote access
When an analyst looks at a message like this, these are the questions that matter most. You can ask them yourself in about two minutes.
1. Is this person really inside your organization?
Don’t trust the display name. Anyone can call themselves “IT Service Desk.” Look at the account details and any “external” label Teams shows. The researchers saw throwaway accounts on addresses ending in .onmicrosoft.com, which is a default domain Microsoft hands out when a Microsoft 365 account is created. Between 30% and 40% of the cases Arctic Wolf investigated used one. Examples included names built from words like “helpdesk,” “itadmin” and “itendpoint.”
Others used paid domains. Of those, roughly half used .top and about 40% used a regular .com. So an ordinary-looking .com doesn’t clear anyone. The point is that a real internal colleague shows up as part of your own company, and an outsider doesn’t. If someone calls themselves “Internal” but Teams marks them as external, that mismatch is your answer.
2. Did you ask for help, and does the timing fit?
Real IT support usually answers a request. Did you open a ticket, call, or email someone? If not, why is someone offering help?
Now think about the last hour. Did your inbox suddenly fill with subscription emails? That combination of a flooded inbox and an immediate offer of help is the pattern the researchers keep seeing. A flooded inbox is annoying, but it doesn’t need a stranger on your computer. Don’t let the pressure set the pace.
3. Can you confirm them another way, before you install or run anything?
Stop the chat. Contact your IT provider or the person you know manages your systems, using a phone number or email you already have, not one the chat gave you. Ask whether they sent the message.
Until that’s confirmed, do not:
- Install or open any remote support tool they name.
- Accept a remote session request.
- Type or paste any command they give you, including anything in PowerShell.
- Open a file they tell you to download.
A genuine support person will understand you checking. Someone running a scam will push back or rush you. That reaction tells you something too.
What to do today
- Tell everyone who uses Teams. Share this: “IT will never message you out of the blue and ask for remote access without us agreeing on it first.”
- Agree on a way to verify. Decide who actually handles IT for you and how they’ll contact you, so everyone can spot an impostor.
- Ask about external chat. Find out whether your Teams allows messages from outside your organization, and if you don’t need it, ask for it to be limited.
- Know which remote tools you really use. If your IT provider uses one of the tools above, you should know which. Then a surprise request from a different one stands out.
- Report the account. Don’t reply. Tell whoever manages your Microsoft 365 so they can check whether others got the same message.
Signs something already went wrong
You may have let them in if any of these apply:
- You installed or approved a remote access program after a Teams chat or phone call you didn’t start.
- You pasted or ran a command someone dictated to you.
- You opened a file at their request.
- Someone controlled your mouse or screen while you watched, or after you walked away.
- A remote tool shows up on your computer that you don’t recognize.
The report notes that attackers can add extra remote tools for backup, so removing the one you saw may not end it. Arctic Wolf also says endpoint and identity monitoring matter alongside message scanning, because the dangerous part happens on the computer, not in the chat. In plain terms, someone needs to be looking at what the computer and your sign-ins are doing.
When to get help
If you’ve given remote access, don’t wait to see what happens. Disconnect the computer from the internet, and contact your IT provider or whoever manages your Microsoft 365 right away. Tell them exactly what you installed, what you typed, and when. If you have no IT provider, Microsoft’s own support is the official place to start. Don’t search for “help” and call whatever number appears first, since that’s another way scammers find people.
If you only got the message and stopped, you’re fine. Report it, and don’t feel foolish. These messages are built to look routine.
Sources
- The Hacker News: Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware (Oct 26, 2026), which reports research from Arctic Wolf Labs and Sophos.
Featured image: Image by StartupStockPhotos from Pixabay.
