Nice2GeekYou

That "IT Help Desk" Call or Teams Chat Could Be a Ransomware Crew: Set a Callback Rule

Cisco Talos reported on October 30, 2026 that attackers posing as IT help desk staff called, emailed and messaged employees on Microsoft Teams and talked them into opening remote access sessions, and one case ended in ransomware. Arctic Wolf has tracked hundreds of similar fake "IT Support" Teams chats. Here's how a small business can shut this down.

  • social-engineering
  • vishing
  • microsoft-teams
  • quick-assist
  • remote-access
  • ransomware
  • mfa
  • cybersecurity
  • smb
  • managed-it

If someone from "IT" calls or messages your staff and asks them to start a remote session, stop and verify first. Cisco Talos Incident Response said on October 30, 2026 that attackers posing as IT help desk staff contacted employees by phone, email and Microsoft Teams during the third quarter and talked them into opening remote access sessions. In one case, a voice phishing call got a user to start a Microsoft Quick Assist session, and the intrusion ended with a new ransomware strain called VYPR.

Why it matters

The attackers didn't need much. Talos said they appeared to know only employee names and email addresses, and they went after whoever would answer, not just executives or IT staff. In one case the victim dialed a fake support number shown in a generic browser scam pop-up and then handed over remote access.

Arctic Wolf Labs, in research published by The Hacker News on October 26, described hundreds of cases following the same playbook. First the victim's inbox is flooded with hundreds of newsletter sign-ups. Then a Teams chat arrives from an outside account with a name like "IT Support (Internal)" or "Help Desk," often from a look-alike Microsoft 365 tenant, offering to fix the problem. The attacker then gets the user to open a legitimate remote tool such as Quick Assist, AnyDesk, ScreenConnect or TeamViewer, and uses that access to install back doors, steal data and launch ransomware.

No software bug is involved. It works because people trust anyone who sounds like their IT department.

What to do this week

  1. Set a callback rule. Tell every employee: real IT support will never mind if you hang up and call back on a number you already know. Never start Quick Assist, AnyDesk or any remote session because an unexpected caller or chat asked you to.
  2. Limit outside Teams chats. In the Microsoft Teams admin center, block or restrict chats from external organizations to the domains you actually work with.
  3. Lock down remote tools. Remove or block remote access apps your business doesn't use, including Quick Assist if your IT provider uses something else, so a scammer can't talk a user into opening one.
  4. Use phishing-resistant MFA. Talos recommends security keys or passkeys (FIDO2) over push or text-message codes, and requiring help desk verification before anyone can add a new MFA method.
  5. Keep your logs. Talos found missing or deleted logs in over 40 percent of its cases and recommends at least 90 days of central log storage kept off the individual computers.

Nice2GeekYou is based in San Antonio, serving all of Texas on site, and our managed IT plans cover remote clients across the U.S. We set up Teams and Microsoft 365 security, control which remote tools can run, and train staff to spot fake help desk calls. Request a quote, see our monthly plans, or text us at (210) 504-8969.

Sources: Help Net Security — Fake IT help desk callers got by on little more than names and email addresses (Oct 30, 2026); The Hacker News — Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware (Oct 26, 2026).