When “Hi, This Is IT” Comes Through Microsoft Teams
Summary: Unit 42 describes threat actors messaging employees through Microsoft Teams while posing as IT support, then talking the worker into approving an MFA prompt to 'confirm their identity' as the compromise proceeds. Phishing alerts from collaboration tools reached 42% of all Cortex phishing alerts in the first four months of 2026, up from 30% in the preceding four months, with actors using typosquatted domains, unaffiliated Microsoft 365 tenants named to mimic IT or MSP functions, and compromised partner accounts.
Why it matters: Teams federation is often enabled by default, so an attacker in an unaffiliated tenant can land a chat in an employee's feed - and the impersonation warnings Microsoft provides still leave the accept-or-reject decision to the user.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026