Microsoft Teams phishing: how fake help desk chats work and how to stop them

The help desk message looks routine. "Hi, this is IT. We've seen the spam hitting your inbox and we're rolling out a filter update. Can you share your screen?" It arrives in Microsoft Teams from an account called Help Desk, minutes after the person's mailbox filled with hundreds of newsletters. Nothing about it passed through your email filter. This guide explains the attack, the Teams settings that close the door, and what to tell staff.

How do attackers use Microsoft Teams to phish employees?

They use external access, the Teams feature that lets people in different organizations chat and call each other. Microsoft documents that users can chat with other Microsoft 365 organizations and with Teams users not managed by an organization, and that the default is to allow all external domains (Microsoft Learn).

An attacker only needs their own tenant. Microsoft's 2024 report on Storm-1811 says "tenants created by the threat actor are used to impersonate help desk personnel." The accounts had display names such as "Help Desk", "Help Desk IT", "Help Desk Support" and "IT Support" (Microsoft Threat Intelligence).

A typical chain looks like this:

1. The email flood. The target's address is signed up to hundreds of newsletters and services. Our guide to email bombing covers this step in detail.
2. The helpful contact. A Teams chat or call arrives from "IT Support" offering to fix the spam.
3. The remote session. The user is asked to open Quick Assist and read back a code, or to approve a "request control" prompt during a Teams screen share.
4. The foothold. The attacker installs tools, steals credentials and moves through the network.

What Microsoft and CISA have reported

The CISA advisory AA24-131A says the actors used email bombing "to aid social engineering over Microsoft Teams and trick victim end users into providing initial access" through remote monitoring and management tools.

Microsoft's September 2026 report lists lures such as "Microsoft Security Update," "Spam Filter Update," and "Account Verification." It notes that some attackers move to a voice call so that "malicious instructions or URLs never enter the chat logs."

Why doesn't email security catch it?

Because the attack doesn't use email after the first step. The flood is email. The phishing happens in Teams chat, a phone call and a remote session.

Teams does show warnings. Microsoft's 2026 report says Teams applies "external tenant labeling, Accept/Block prompts, message previews, and phishing indicators" at first contact. The attack works when a stressed user, buried in spam, clicks through those warnings because the message offers exactly the help they need.

Some built-in protection exists. Every Teams license includes near real-time URL warnings: known malicious links in chats get a warning, and messages found to contain malicious URLs up to 48 hours after delivery receive one too (Microsoft Learn). But a help desk impersonation often contains no link at all, just a conversation.

Which Teams settings stop external help desk scams?

Everything below is in the Teams admin center under Users > External access, at the time of writing (October 2026). Microsoft says each external access option has both an organization setting and user policies, both are on by default, and a user needs both to allow it.

1. Allow only the domains you work with

Under Teams and Skype for Business users in external organizations, Microsoft offers four choices:

An allowlist defeats the attacker's main advantage: a brand-new tenant your users have never heard of. Microsoft's 2026 guidance says to "restrict Teams external access to trusted domains only." Note that people from blocked domains can still join meetings anonymously if anonymous access is allowed.

If you block domains, subdomains aren't blocked by default. Microsoft documents Set-CsTenantFederationConfiguration -BlockAllSubdomains $True to change that.

2. Turn off unmanaged Teams accounts if you don't need them

Unmanaged accounts are personal Teams accounts that no organization manages. Two settings control them:

• People in my organization can communicate with unmanaged Teams accounts. Turn it off to prevent chat with these accounts entirely.
• External users with Teams accounts not managed by an organization can contact users in my organization. If you keep the first setting on, clear this one. Microsoft says unmanaged users then "can't search by email address to find users in your organization," and your users must start every conversation.

In PowerShell, the matching parameters on Set-CsTenantFederationConfiguration are -AllowTeamsConsumer and -AllowTeamsConsumerInbound.

3. Keep trial-only tenants blocked

Microsoft lets you control chat with Teams trial-only tenants, those without purchased licenses, through -ExternalAccessWithTrialTenants. The default is Blocked. Check that nobody changed it. It doesn't cover tenants with paid licenses, so it's a backstop, not a fix.

4. Give wider access only to the people who need it

External access policies, on the Policies tab of the same page, let you set rules per user or group. A sales or account team can chat with a wider set of domains while everyone else stays on the allowlist. Microsoft's example: turn the setting off in the org-wide default policy, then create a custom policy with it on and assign it to the users who need it.

5. Block known bad actors quickly

• Block specific users from communicating with people in my organization lets you add individual external addresses, up to 200. It's off by default. Blocked users are removed from existing chats.
• Allow my security team to manage blocked domains (in public preview at the time of writing) lets security admins block external Teams domains from the Tenant Allow/Block List in the Defender portal. It needs Defender for Office 365 Plan 1 or Plan 2, and Microsoft lists it as working only when the organization setting is Allow all external domains or Block only specific external domains, so it isn't available alongside an allowlist.

6. Turn on Defender for Office 365 Teams features if you have them

With Defender for Office 365 Plan 1 or higher, Microsoft provides Safe Links for Teams, ZAP for Teams, Teams messages in quarantine and user-reported Teams items, so staff can report a suspicious message, call or meeting participant. Check that ZAP for Teams is on in the Defender portal under Settings > Email & collaboration > Microsoft Teams protection. Our comparison of Defender for Office 365 Plan 1 and Plan 2 shows what each tier adds.

What about Quick Assist and remote tools?

The Teams chat is the approach. The remote session is the break-in. Microsoft's 2024 guidance recommends you consider "blocking or uninstalling Quick Assist and other remote monitoring and management tools" you don't use, and removing Quick Assist if you use a different support tool.

Its 2026 report adds that you should "require device- or identity-based access checks before any remote support session is granted" and limit or monitor remote-support software. If your IT provider uses one specific tool, write that down and tell staff. Any other tool, offered by anyone, is a red flag.

What should staff do when "IT" messages them on Teams?

Give people a short rule they can remember under pressure. Microsoft's 2026 advice is to "treat any unsolicited external Microsoft Teams chat or call claiming to be IT or helpdesk as suspicious," and to train staff to "never grant remote access or run commands provided by an unsolicited contact."

A checklist for staff:

1. Look for the External label. Your real IT team uses your company's accounts. An External tag or a message request on "Help Desk" means it isn't them.
2. Don't accept the chat if you weren't expecting it. Use Block, or Block and Report if it's offered. Microsoft says a reported person's contact and messages "will be shared with your IT admin for review" and "they won't know that you reported them" (Microsoft Support).
3. Never open Quick Assist, share your screen or read out a code for someone who contacted you first.
4. Never approve a sign-in prompt you didn't start. Microsoft's 2024 guidance tells users to "never share their account information or authorize sign-in requests over chat."
5. Call IT back on a number you already have, or use your normal ticket system.
6. If you already let someone in, disconnect, unplug from the network if you can, and tell IT straight away.

Some organizations add a help desk verification phrase, which Microsoft's 2026 report recommends as "internal helpdesk authentication phrases." Whatever you choose, tell staff how IT will contact them, and how it never will.

What should admins do if someone accepted the chat?

Treat it as a possible compromise, even if the user says they ended the session quickly.

1. Isolate the device and check for new remote tools, scheduled tasks and installed software.
2. Reset the user's password and revoke sessions, and review their MFA methods. Our guide to signs an email account is compromised lists where to look.
3. Block the external domain or user in Teams external access.
4. Rotate credentials that were usable from that device. Microsoft's 2026 report says this includes domain admin accounts if the device was domain-joined.
5. Warn other staff with the exact display name and domain the attacker used. Groups like this usually target several people.
6. Check the user's mailbox for the email flood and any alerts hidden inside it.

Next steps

• Open Users > External access in the Teams admin center today and switch to an allowlist of the domains you work with.
• Turn off unmanaged Teams accounts, or at least stop them starting conversations.
• Decide which remote support tool your IT uses, remove Quick Assist if it isn't that tool, and tell staff the rule.
• Add Teams scenarios to your security awareness training.
• Stop the flood that sets up the call. A filter with per-user quarantine lets you hold a subscription bomb for review instead of leaving it in the inbox. iBlockSpam gives every user a personal quarantine with digests.

Browse our other phishing and threat guides.