{"id":1774,"date":"2026-10-30T02:00:00","date_gmt":"2026-10-30T09:00:00","guid":{"rendered":"https:\/\/rainier-it.com\/blog\/?p=1774"},"modified":"2026-10-29T20:14:20","modified_gmt":"2026-10-30T03:14:20","slug":"teams-it-support-scam-warning","status":"publish","type":"post","link":"https:\/\/rainier-it.com\/blog\/teams-it-support-scam-warning\/","title":{"rendered":"Teams IT Support Scam: Fake Help Desk Chats Spread"},"content":{"rendered":"\n

A new wave of the Teams IT support scam is hitting offices. Researchers at Arctic Wolf Labs say criminals are messaging people in Microsoft Teams while posing as the help desk, then talking them into installing malware. The Hacker News reported the findings on Oct. 26, 2026<\/a>.<\/p>\n\n\n\n

The researchers describe a “recurring social engineering pattern” across hundreds of cases. In plain words, the same trick is working again and again.<\/p>\n\n\n\n

If your office uses Microsoft 365 and Teams, this one is for you. If you only use Teams to chat with family or friends, you can relax a bit, but the same trick works over the phone and by text too.<\/p>\n\n\n\n

How the Teams IT support scam works<\/h2>\n\n\n\n

It usually goes in two steps.<\/p>\n\n\n\n

First, your inbox gets flooded. Hundreds of newsletter and subscription confirmation emails arrive in a short span. Researchers call this “mail bombing.” It is meant to make you feel something is badly wrong.<\/p>\n\n\n\n

Second, a Teams message arrives from someone calling themselves “IT Support” or “Help Desk.” They offer to fix the email problem. Of course, they caused it.<\/p>\n\n\n\n

From there, the goal is to get you to let them in, often with a remote-access tool. That is a program that lets another person control your computer from far away. Once they are in, they can install malware or ransomware. Ransomware locks up your files and demands money.<\/p>\n\n\n\n

What the fake messages look like<\/h2>\n\n\n\n

According to the report, the attackers use names that sound official. Examples include “Help Desk,” “IT Service Desk,” “HelpDesk Manager” and “Enterprise IT & Security (Internal).” Some use a friendly first name in parentheses.<\/p>\n\n\n\n

Teams normally warns you when a chat comes from outside your organization. These names are chosen to make you ignore that warning. The word “Internal” in a display name is a favorite trick. Anyone can type anything into a display name.<\/p>\n\n\n\n

Arctic Wolf also saw a recent shift. Attackers have started adding the target company’s name to the display name to look more believable.<\/p>\n\n\n\n

Where the messages come from<\/h2>\n\n\n\n

The attackers set up their own Microsoft 365 accounts, called tenants, just to send these chats. Arctic Wolf says nearly 30\u201340 percent of the cases it looked at used an address ending in .onmicrosoft.com<\/em>. Microsoft creates that address automatically for every new tenant. The scammers pick help-desk-sounding names for it.<\/p>\n\n\n\n

Lately they are also paying for their own web domains. Of the paid domains Arctic Wolf identified over the past few months, about 50 percent used the .top<\/em> ending. Around 40 percent used a standard .com<\/em>.<\/p>\n\n\n\n

You don’t need to memorize any of that. The point is that the sender is an outsider, whatever the name says. The report links this activity to a group tracked as STAC4749.<\/p>\n\n\n\n

What this means for a small office<\/h2>\n\n\n\n

Small offices often don’t have an in-house IT person. That is exactly why this works. If you don’t know who the real IT person is, “IT Support” sounds helpful. A busy day, a flooded inbox and a friendly offer make a bad mix.<\/p>\n\n\n\n

Here is a simple rule we give everyone: real IT help never surprises you.<\/strong> If you didn’t ask for help, treat the offer as suspect.<\/p>\n\n\n\n

We covered a similar pressure trick in our post on the vendor invoice scam<\/a>. Different bait, same idea: create urgency, then get you to act before you think.<\/p>\n\n\n\n

What to do this week<\/h2>\n\n\n\n