A Microsoft report describes two incidents in which attackers used Microsoft Teams messages and calls to pose as IT or help desk staff. They persuaded employees to grant remote access, primarily through Quick Assist, and then gained hands-on access to corporate workstations.
The attackers guided users to open Quick Assist and share a connection code. Once connected, they installed software using Python, Bun or Java runtimes, accessed networks and set up authentication, according to the report. The incidents relied on employees trusting communications that appeared to come from workplace support personnel, rather than on vulnerabilities in Teams itself.
Microsoft told CNET it is introducing AI-powered phishing detection that uses conversation context to identify phishing and social engineering in higher-risk situations, particularly first-contact chats with external users. The company’s roadmap also includes options to report suspicious guest invitations and blur QR codes from external senders.
Microsoft advises users to verify the identity of external senders and check requests before acting. Administrators can block external Teams users and limit which people in their organization may chat or meet with contacts outside the enterprise.
Yu Cai, associate director of the Institute of Computing and Cybersystems at Michigan Tech, said human-led social engineering remains a major cybersecurity threat. He added that AI tools such as voice cloning and deepfake videos can make these attacks more convincing, even though the Teams incidents showed that an apparently simple approach can be enough to gain access.
Sources: CNET.