Nearly a Third of Monitored Companies Got a Fake ‘IT Support’ Contact on Microsoft Teams
A new threat report finds that about 30% of the organizations one security provider monitors saw at least one fake IT support attempt over Microsoft Teams in the first half of 2026. Here is what the attackers are doing and how layered defenses take the air out of it.
Here Is How Layered Defenses Help When the Help Desk Isn’t Really the Help Desk
A message pops up in Microsoft Teams from someone calling themselves IT support. They say there is a problem with your account and they need you to approve a remote session or run a quick fix. For a growing number of companies, that message is the opening move of an attack.
The figures here come from managed security provider Ontinue’s first-half 2026 threat report, announced in a press release published October 13. Keep in mind they describe the organizations Ontinue monitors, not every business.
What the report found
- About 30% of monitored organizations saw at least one attempt to impersonate IT support through Microsoft Teams in the first half of 2026.
- Roughly one in every 990 external Teams contacts showed signs of impersonation.
- The goal is to talk an employee into granting remote access or running something malicious. No software vulnerability is needed.
- Ontinue confirmed 10 device-code phishing compromises across five customer tenants in May and June 2026. In these, the victim signs in through a genuine Microsoft page, and the attacker ends up with access without ever learning the password.
- In more than 10,800 suspicious ClickFix campaigns it analyzed, 25.3% of the confirmed malicious ones relied on blockchain-based command-and-control infrastructure to hide how payloads were delivered, and 6,188 delivery domains led back to only 158 payload hosts.
Ontinue’s director of advanced threat operations, Balazs Greksza, summed it up: “The majority of effective attacks today don’t rely on sophisticated exploits. They rely on trust.”
Why one control isn’t enough
Each piece of this attack looks legitimate on its own: a real Teams message, a real Microsoft sign-in page, a real remote support tool. A filter that hunts for bad links or malware files has little to catch. What stops it is several modest layers, each covering a different moment in the conversation.
What this means for your company: the layers, in order
- Decide who can message your staff from outside. Most collaboration platforms let you limit external chat to approved partner organizations or turn it off for people who don’t need it. In Microsoft Teams, external access settings are one example. Fewer strangers means fewer fake technicians.
- Make the real help desk easy to recognize. Tell staff exactly how IT will contact them, and that genuine support will never cold-message asking for remote access or a sign-in code. Give them one way to check, such as calling back on a number they already know.
- Control remote access tools. Allow only the remote support software your IT team actually uses, and block or remove the rest, including built-in tools you don’t rely on. Application control features on business endpoints can enforce this.
- Harden sign-in. Move toward phishing-resistant methods such as passkeys or security keys, and switch off sign-in methods you don’t use. If no one in your company needs device-code sign-in, conditional access rules in identity platforms such as Microsoft Entra ID can block it.
- Watch what happens on the device. Endpoint detection and response tools can flag a remote support tool being installed, or a chat app launching scripts, even when the user approved it.
- Practice the conversation. Short drills that imitate a fake support contact teach people to pause and verify. Make reporting a suspicious message quick, and thank people who do it.
None of these layers needs to be perfect. Together they make sure a single convincing message isn’t enough to hand an attacker the keys.
Need help tightening Microsoft Teams and sign-in settings so fake help desk messages go nowhere? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
