Fake IT chats turn Microsoft Teams into a rapid malware path
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Wednesday, October 28th, 2026.
Employees are being flooded with unwanted email and then contacted through external Microsoft Teams chats by attackers posing as internal IT support. More than 400 incidents followed a recurring pattern. Targets were contacted in short windows, and malware sometimes began running in under 15 minutes. The impostors commonly asked employees to grant remote access through legitimate support tools. Roughly fifteen percent of the observed cases progressed beyond the initial stage.
This campaign abuses trusted collaboration features rather than a software vulnerability. For leaders, an open external-chat policy can give attackers a direct social-engineering route into the workforce. For defenders, the Teams ChatCreated event provides an early detection point, while unauthorized use of remote-support software is another strong signal. Once access is granted, attackers may steal credentials, move laterally, deploy malware or pursue ransomware. The larger lesson is that familiar business tools become dangerous when trust settings and support processes are unclear. Allowlist trusted external organizations, restrict remote-support tools and teach employees exactly how legitimate IT staff initiate and verify assistance.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
