It works because it looks like a Tuesday morning.

If your staff have ever been contacted by an IT provider they did not expect, and did anything other than hang up and call back on a number they already had, this one is worth ten minutes of your time.

What actually happens

Microsoft set out the chain in detail. The short version:

1. First contact through Teams. The attacker operates from an external Microsoft 365 tenant and starts a chat or call posing as internal IT or helpdesk. Common pretexts include a security update, a spam filter update, account verification, or a warning that an account is about to be deactivated. Sometimes they phone as well, so the instructions never appear in the chat log.
2. The user grants remote control. They are talked through approving a “request control” prompt during a Teams screen share, or opening Quick Assist and reading back the connection code. From the user’s side this feels exactly like being helped.
3. Software gets installed silently. Inside that session the attacker runs PowerShell to pull down an installer package from cloud storage and installs it with the interface suppressed. The user sees nothing. The files are named things like “devfix” and “Hotfix” to fit the helpdesk story.
4. The attacker sets up camp. The package stages a legitimate, signed JavaScript runtime downloaded from the official source, then uses it to run an encrypted implant. Because every component is legitimate and signed, tooling that only looks for unsigned executables has nothing to flag. Persistence is set up under an update-themed name so it restarts every time the user logs in.
5. They look around, then move. Screenshots of the desktop are captured periodically. The attacker enumerates domain accounts and servers, then pivots across the network toward domain controllers and certificate authorities.

Microsoft is direct about what that pattern usually precedes: data theft, extortion, ransomware.

The part worth sitting with is that nothing here was hacked. Teams shows external contact warnings, an accept or block prompt, and phishing indicators. The whole attack depends on persuading one person to click past them.

Why this is a small business problem, not just a large one

It is easy to read “domain controllers” and “certificate authorities” and file this under enterprise. Two reasons not to.

First, the entry point is the same everywhere. A 12-person care agency and a 12,000-person bank both run Teams, both have someone who answers messages, and both have staff who have been trained for years that the helpful thing to do is cooperate with IT.

Second, smaller organisations are easier to impersonate. In a large company, an unexpected message from “IT” is odd because nobody knows the IT team anyway, so the culture is to check. In a 10-person firm that outsources IT, staff are used to a named external person contacting them from outside the organisation. That is the normal state. The attacker is not fighting your culture. They are using it.

If you outsource IT, external contact from IT is not a red flag for your staff. It is Tuesday. That is the gap.

Four controls that actually close this

Microsoft’s guidance runs long. Four things carry most of the weight for a small regulated firm.

1. A verification rule your staff can follow under pressure.

Not awareness training in general. One rule, written down, that survives someone sounding urgent and authoritative:

Nobody from IT will ever contact you out of the blue and ask for remote access. If it happens, end the conversation and call the support number yourself. You will never be in trouble for checking.

That last sentence matters more than the rest of it. Most people who fall for this had a doubt and pushed past it, because raising it felt rude. Give them explicit permission and the rule works. Without it, it does not.

If you want to see how your own team would do, our Spot the Phish quiz takes two minutes and is a useful thing to put in front of staff at a team meeting.

2. Restrict who can reach your staff in Teams.

Teams external access can be limited to trusted domains. Most small firms leave it open to the entire world by default and have no idea. If your staff only ever collaborate with a handful of outside organisations, the setting should reflect that. It is a configuration change, not a purchase.

3. Phishing-resistant MFA and Conditional Access.

MFA on its own does not stop someone who has been handed live control of a logged-in machine. Conditional Access, requiring a managed and compliant device, limits what that session is worth. This one also has a compliance edge: under Cyber Essentials Requirements for IT Infrastructure v3.3, effective 27 April 2026, MFA is mandatory on every cloud service where it is available, including where it costs extra. Not enabling it is an automatic fail. If you are certifying or renewing this year, our Cyber Essentials readiness checker will tell you where you currently stand.

4. Control which remote support tools can run at all.

Quick Assist and general-purpose remote support tools are the delivery mechanism here. If your IT provider uses one specific tool, the others should not be usable on your machines. Restricting remote assistance software removes the attacker’s easiest route, and it takes an afternoon.

The awkward question for anyone who outsources IT

This attack impersonates your IT provider. So ask us, or whoever supports you:

• Which channels will you ever contact my staff on, and what will you never ask them to do?
• What number should my team call to verify that a request came from you?
• Which remote support tool do you use, and are the others blocked on our devices?
• Is Teams external access restricted on our tenant, or open to anyone?
• If someone did grant a stranger remote access on Monday morning, what would tell you, and how fast?

A provider who cannot answer the last one has a monitoring gap, and it is the question that decides whether this is an incident or a disaster.

For our part, Guard IQ contacts clients through three channels only: our support email, our office number on 020 8537 8167, and our published WhatsApp number. Anything else claiming to be us is not us. If in doubt, hang up and call the office. We would rather take a hundred unnecessary calls than one that came too late.

If you want a second opinion

We work with care and healthcare providers, law firms, accountancy practices and other regulated businesses across North West London and the Home Counties, where a breach is not just downtime but a reportable incident with a regulator attached.

If you are not sure whether your Teams external access is locked down, whether Conditional Access is doing anything, or what your staff would actually do if a convincing stranger asked for remote control, book a free consultation or call 020 8537 8167.

Source: Microsoft Security Blog, “Impersonating IT support: how threat actors turn a remote session into enterprise-wide access”, 2 September 2026.

The post Someone calls claiming to be your IT support. How does your team check? first appeared on Guard IQ | IT Support & Cybersecurity Services in North West London.