Attackers pose as the help desk in Teams chats and calls to get remote access. How to spot it and check.
Attackers are contacting staff through Microsoft Teams, posing as the IT help desk. Microsoft has described cases where someone posing as IT support talked an employee into sharing their screen through Quick Assist, then into typing their password into a fake page.
Warning signs
- A Teams chat or call you didn't expect, from “IT Support”, “Help Desk” or a name you don't know
- The account is marked External, or belongs to another organization
- It follows a sudden flood of spam emails, with an offer to “fix” it
- A request to install a tool, share your screen, give remote access or approve a sign-in
What to do
- Don't share your screen or give remote access to anyone who contacted you first.
- Check it's really us. End the call or close the chat, and call DeepNet on 707-755-8000.
- Report it, so we can block the account and warn your colleagues.
Already let someone in? Disconnect from the internet and call us straight away.
