MICROSOFT SECURITY
September 2026 Security Update
Microsoft Confirms Active Fake IT Support Attacks Through Teams
Microsoft has confirmed an active campaign in which attackers impersonate IT or helpdesk personnel through external Microsoft Teams chats and calls.
The attacker may claim there is a problem with your computer, Microsoft 365 account, security software, or spam settings. They then try to convince you to share your screen, approve a Request Control prompt in Teams, or open Quick Assist and provide a connection code.
Once remote access is granted, the attacker can take control of the computer, install malicious software, steal information, and potentially use the compromised device to reach other systems on the company network.
If someone unexpectedly contacts you through Teams claiming to be PCC, Microsoft, or your IT department, do not grant remote control or provide a Quick Assist code. Contact your normal IT support contact using a phone number or support method you already know and trust.
A message or call in Microsoft Teams can look like it came from your IT department even when it did not. Criminals are increasingly using Teams to impersonate technical support, gain an employee’s trust, and convince them to provide access to their computer or account.
The good news is that a few simple habits can stop most of these attacks.
Share This With Your Team
Download our one-page Microsoft Teams Scam Safety Guide for a quick reference employees can save, print, or share.
How the Scam Works
The attacker contacts an employee through Microsoft Teams and pretends to be IT support, Microsoft support, or another trusted person.
They may tell you:
- There is a problem with your computer or Microsoft 365 account.
- Your account needs an urgent security update.
- They need to troubleshoot something remotely.
- You need to approve a request or open a support tool.
- You need to provide a password, verification code, or other information.
The attacker may sound professional and may use legitimate Microsoft tools. That does not make the request legitimate.
Warning Signs to Watch For
Unexpected IT Contact
Someone contacts you about a technical problem you did not report.
External Sender
Teams identifies the person as outside your organization or asks you to accept a new conversation.
Pressure or Urgency
You are told you must act immediately to prevent an account or
computer problem.
Remote Access Requests
Someone asks you to open Quick Assist or another remote-control tool.
Passwords or Verification Codes
Legitimate support personnel should not need you to give them your
password or multifactor authentication code.
Unexpected Links or Files
You are asked to visit a website, download software, or open a file
as part of the support request.
Quick Safety Checklist
- Stop. Do not follow instructions immediately.
- Check whether Teams identifies the sender as external.
- Do not share passwords or MFA verification codes.
- Do not approve an unexpected remote-access request.
- Do not click unexpected links or download files.
- Verify the person through a separate, trusted method before continuing.
- Report suspicious messages to your IT provider or security team.
What If You Already Responded?
Do not try to determine on your own whether the interaction was harmless.
Contact your IT support provider immediately if you:
- Allowed someone to remotely access your computer.
- Entered your Microsoft 365 password into a website they provided.
- Shared a verification or MFA code.
- Opened a file or installed software at their direction.
- Clicked a suspicious link.
The sooner your IT team knows what happened, the sooner they can review the account and device and take appropriate security measures.
Microsoft Teams Security Guidance
Microsoft recommends taking extra care with unexpected Teams messages,
particularly when the sender is outside your organization. Verify the
sender’s identity, review unexpected messages carefully, and only accept
conversations when you are confident the sender is legitimate.
Read Microsoft’s guidance on suspicious external Teams chats
Not Sure Whether a Teams Message Is Legitimate?
Stop before responding. PCC clients can contact us and we will help verify whether the request is legitimate.
Professional Computer Concepts
Phone: 415-897-0078
Email: [email protected]
Client Portal:
Open the PCC Client Portal