Fake IT support on Microsoft Teams, and how to stop it.

How does the fake IT support scam on Teams work?

Microsoft Threat Intelligence has documented this pattern in detail, tracking a financially motivated group it calls Storm-1811 whose intrusions led to Black Basta ransomware. Microsoft's write-up of the campaign describes a chain that is simple enough to run against any business on Microsoft 365:

1. Email bombing. The attacker signs your employee up to dozens of newsletters and mailing lists. Their inbox floods and they can't work.
2. The helpful contact. Shortly afterwards, someone calls or sends a Teams message offering to fix the spam. Microsoft observed attackers using their own Microsoft 365 tenants with display names such as "Help Desk", "Help Desk IT" and "IT Support".
3. The remote session. The "technician" asks the user to press Ctrl + Windows + Q to open Quick Assist, enter a security code and approve full control of the screen.
4. The payload. With control, the attacker downloads scripts dressed up as a "spam filter update", sometimes asks the user to type their password into a fake page, and installs remote access tools that keep them in after the call ends.
5. The spread. From one laptop they move across the network and, in the cases Microsoft documented, deployed ransomware.

Nothing here is a software flaw. Every step uses a feature working as designed: open external chat, a built-in remote support app, and a stressed employee who wants their inbox back.

Why do these scams work so well?

Staff have been trained for years to distrust strange emails. Far fewer think twice about a Teams chat, because Teams feels internal. Three things make this attack land:

• The timing is engineered. The spam flood creates a real problem, so a message offering to fix it feels like good service, not an intrusion.
• Teams is open by default. Microsoft's documentation confirms that external access defaults to Allow all external domains, meaning people in other organisations can chat with your users if they know their email address. Email addresses are rarely secret.
• The tools look legitimate. Quick Assist is a genuine Microsoft app that ships with Windows. Antivirus has no reason to block it, and the user is the one who lets the attacker in.

Teams does show an External label and an accept-or-block prompt for a first chat from outside your organisation, and Microsoft added brand impersonation warnings for first-contact external messages in January 2025. Those help, but a busy person staring at an inbox full of spam will click past a lot of warnings.

Which Teams settings stop external scam messages?

Most of the fix lives in the Teams admin center under Users > External access. Microsoft's external access guide walks through each option. Here is how they compare for a typical SME:

Summarised from Microsoft Learn at time of writing. User reporting of Teams messages and calls requires Microsoft Defender for Office 365 Plan 1 or Plan 2, which Microsoft 365 Business Premium includes.

An allow list takes an afternoon to build: export a list of the external domains your team actually chats with, confirm them with each department, and switch over. If you block a domain by mistake, adding it back takes a minute. If you leave everything open, the attacker needs only one employee to accept one chat.

Should you remove Quick Assist?

If your IT provider uses a different remote support tool, yes. Microsoft's own guidance in its threat report is to block or uninstall Quick Assist and any other remote management tools you don't use. Its Quick Assist documentation also suggests that organisations supporting users inside a single Microsoft Entra tenant consider Intune Remote Help instead, which adds Conditional Access, role-based permissions and session logging.

The same thinking applies to AnyDesk, TeamViewer and similar apps. Keep exactly one approved remote support tool, block the rest, and make sure staff know which one is real. Device management through Microsoft Intune is the practical way to remove an app from every company laptop at once and stop it coming back.

What should you tell your staff?

Settings narrow the door; people decide whether to open it. Give your team one rule they can remember under pressure:

Back that rule up with a few specifics:

• Check for the External label. Your IT provider or internal IT team contacts you from inside your organisation or through a channel you already use, never from an unknown external account called "Help Desk".
• Report, don't just ignore. In Teams, hover over the message, select More options, then Report this message. A report alerts your admins so they can warn everyone else.
• Expect the spam flood. If your inbox suddenly fills with sign-up emails, tell IT. It is often the opening move, not a random glitch.
• Never approve a sign-in you didn't start. If an MFA prompt appears while someone is "helping" you, deny it. Phishing-resistant sign-in, covered in our guide to passkeys and the SMS MFA retirement, makes stolen passwords far less useful.

Short, regular practice beats an annual slideshow. Our security awareness training guide covers how to run it without taking up much of anyone's week.

What to do if someone already let a fake technician in

1. Disconnect. End the remote session and take the device off the network: unplug the cable and turn off Wi-Fi.
2. Call your IT provider immediately. Speed matters more than having every detail. Note what the caller asked for and when.
3. Lock the account. Reset the user's password, revoke their active sign-in sessions and review their MFA methods for anything new.
4. Check the device. Run a full scan, look for newly installed remote access tools, and if in doubt, wipe and rebuild it rather than trust it again.
5. Assess the data. If personal data may have been accessed, work through your PDPA data breach process, including whether the incident must be notified to the PDPC.

If you're unsure how your backups would hold up if this turned into ransomware, our Ransomware 101 guide is a good next read.

What this means for Singapore SMEs

Under the PDPA's Protection Obligation, organisations must make reasonable security arrangements to protect personal data. Leaving Teams open to every external tenant and Quick Assist on every laptop is hard to call reasonable once you know how this attack works. Restricting external access and controlling remote tools also map neatly onto the access control and secure configuration areas of CSA Cyber Essentials.

At Cloudeli, our Cloudeli Secure package (US$28.50 per user per month on an annual plan) includes anti-phishing and malware protection for email, Teams and SharePoint. Cloudeli Complete (US$36.60) adds Microsoft Defender for Business and security awareness training with phishing simulations. Whichever way you go, the first step is free: check who can message your staff on Teams today.

This article is general guidance, not legal advice.