Fake IT Support Scams: 30% of Organizations Targeted via Microsoft Teams Calls

| Editorial Team On 16 Oct, 2026

Fake IT Support Scams Hit 30% of Organizations via Microsoft Teams Calls

A new threat intelligence report reveals that nearly one-third of monitored organizations faced fake IT support impersonation attempts on Microsoft Teams in early 2026 — with successful attacks averaging a patient 20-minute conversation rather than a quick script.

The findings come from Ontinue's 1H 2026 Threat Intelligence Report, released October 13 by the Zurich-based MXDR provider's Advanced Threat Operations team. The report delivers an uncomfortable message for security professionals: the most dangerous attacks of 2026 don't look like attacks. They look like a Teams message from someone in IT, a genuine Microsoft sign-in page, or a package pulled from a familiar repository. Defenders are increasingly losing ground not because attackers are smarter but because they are more patient — and more willing to exploit the trust that organizations place in their own tools.

The Anatomy of a 20-Minute Compromise

Ontinue reviewed 393,433 external Teams contacts involving 42,240 outside organizations. Approximately one in every 990 contacts carried at least one sign of IT-support impersonation. The technique traces its lineage to Black Basta affiliates in mid-2024. Even after Black Basta fragmented when its internal chat logs leaked in February 2025, Teams-based voice phishing — or vishing — continued through 2026 under operators with no established connection to the original crew. The tradecraft outlived its creators.

How the Playbook Works

The playbook is consistent regardless of who runs it. An external "helpdesk" user opens a chat or call, cites an urgent device or security problem, and walks the target into launching Quick Assist, installing a remote tool, or running a PowerShell command. Quick Assist remains the favourite because it ships with Windows and requires no admin rights. Ontinue also observed AnyDesk, ScreenConnect, TeamViewer, and Level.io used in these campaigns.

"The majority of effective attacks today don't rely on sophisticated exploits. They rely on trust. Whether it's an attacker impersonating IT support through Microsoft Teams, abusing legitimate authentication workflows, or hiding command-and-control infrastructure within trusted services, we're seeing cybercriminals focus on blending into everyday business activity."
— Balazs Greksza, Director of Advanced Threat Operations, Ontinue

Scam calls ranged from 60 seconds to more than 30 minutes. The short calls mostly represent failures — declined connections and suspicious users who never engaged. Successful compromises clustered around the 20-minute mark. That single finding inverts a common assumption: attackers who win aren't rushing. They are building rapport, handling objections, and walking a victim through remote access step by step. Users braced for a 30-second scam are poorly prepared for a 20-minute conversation with someone who sounds like a trusted colleague.

Understanding how to defend your organisation against social engineering attacks has never been more critical, precisely because these interactions are engineered to feel routine rather than threatening.

TWINLOOT: A Previously Undocumented Implant

One such call led Ontinue's Cyber Defense Center to discover TWINLOOT — a previously undocumented modular Python implant that required no exploit and no malicious attachment. An operator posing as IT support convinced a target to run a PowerShell command which pulled down an archive containing a Python runtime and a compiled loader. Its command and control ran entirely inside Microsoft services: SharePoint Online file dead-drops via the Microsoft Graph API and Microsoft Teams TURN relay infrastructure for interactive operator access. To most network monitoring tools, that traffic looks indistinguishable from Microsoft 365 doing its job.

This is precisely what makes TWINLOOT so significant — it leaves no traditional footprint. There is no malicious email attachment, no suspicious domain, and no exploit to catch at the perimeter. The entire compromise rides inside infrastructure that security teams are conditioned to trust.

Identity Compromise Without a Password

The report's identity section presents some of the most unsettling findings for Microsoft-centric organisations. Ontinue confirmed 10 device code phishing compromises across five customer tenants in May and June 2026. Device code flow is a legitimate OAuth mechanism built for smart TVs and printers. In these attacks, victims authenticated on genuine Microsoft pages — sometimes completing multi-factor authentication — but the code they entered authorised an attacker's session. No password ever changed hands.

In a financial services case, the attacker moved from initial consent to sequential access of Microsoft Graph, Azure AD, and the Device Registration Service in just two minutes. In some cases, no default Microsoft Sentinel alert fired. The speed and silence of this progression underscores a critical gap: organisations are investing in detection tooling that was built for a different threat model.

The Passkey Migration Problem

Microsoft's decision to auto-enable passkey profiles for tenants that hadn't configured them between April and late May 2026 added another wrinkle. Ontinue warns the change cuts both ways. Tenants that never set attestation landed on a more permissive default allowing synced passkeys. As passkeys make direct session phishing harder, the report expects attackers to pressure the seams: legacy MFA fallbacks still accepted by Conditional Access and helpdesk recovery paths like Temporary Access Pass issuance. Passkeys are phishing resistant. The migration to them is not automatically attacker resistant.

Reviewing your Microsoft Teams security settings and configuration best practices is a practical step that can meaningfully reduce exposure to these impersonation techniques before they reach your users.

"These attacks work because they leverage the same tools employees use every day. The most dangerous attacks increasingly look like normal business activity."
— Craig Jones, Chief Security Officer, Ontinue

Trust as the Attack Surface

Two detection findings from the report should prompt immediate rule rewrites.

First, the disguise lives in the mailbox address — not the display name. Impersonation signs appeared in the address (think helpdesk@) at 7.5 per 10,000 contacts versus 5.0 for display names and just 0.15 for lookalike characters. Security teams inspecting only display names are reading the weaker signal.

Second, email bombing is the clearest tell. Several campaigns flooded a target's inbox with subscription spam, then called offering to fix it. A sudden mail spike followed within minutes by an inbound external Teams call is the highest-fidelity signal available for this technique.

What the Expert Community Is Saying

The expert community is consistent in its diagnosis. Mika Aalto, Co-Founder and CEO of Hoxhunt, warns that phishing has escaped the inbox entirely. "Attackers now move between email, Microsoft Teams, Slack, text messages, phone calls, and remote-access tools, with each interaction making the next one feel more credible," he said. He urges teams to treat password resets, MFA changes, and device enrollment requests made during unsolicited support interactions as high-risk events requiring correlated analysis rather than separate queues.

Aviv Nahum, Co-Founder and CEO of Above Security, argues the security model must shift: "From 'does this look real?' to 'can I independently verify that this person is who they claim to be?'" Jason Soroko, recognising social engineering red flags starts at the help desk — which typically relies on knowledge-based authentication that skilled threat actors bypass without effort. Shane Barney, CISO at Keeper Security, frames the broader gap plainly: collaboration platforms carry implicit trust that rarely receives the same scrutiny as privileged accounts. That is the blind spot.

The Declining Cost of Attack

The cost of attack is falling and Ontinue's data show precisely where the savings come from. Attackers no longer need to break in when they can be invited. A helpdesk address, a legitimate Microsoft login page, and 20 patient minutes on a Teams call can produce a full compromise with no exploit required. For a broader understanding of how these manipulation techniques operate at scale, the MITRE ATT&CK framework documents the specific tactics, techniques, and procedures associated with phishing and social engineering in enterprise environments.

How to Act on This Information

Rewrite detection rules immediately. Shift impersonation monitoring to inspect the local part of email addresses rather than display names and build an alert that correlates inbox flooding with an inbound external Teams call arriving within minutes.
Train employees for patience, not panic. Security awareness programmes should simulate a calm 20-minute conversation with a credible-sounding caller — not a rushed phishing script — and provide a verified internal channel employees can use to confirm any unsolicited IT contact.
Tighten passkey and help desk configurations now. Default to device-bound passkeys with attestation, restrict device registration to managed compliant devices, and require short-lived one-time Temporary Access Passes with a logged reason for every issuance before legacy MFA fallbacks are retired.