Beware Fake IT Support Calls On Microsoft Teams

Cybercriminals are once again finding clever ways to exploit trust. The latest threat involves fake IT support calls on Microsoft Teams, where attackers impersonate support staff and persuade employees to hand over control of their computers.

This campaign starts with a phishing email disguised as an employee survey. Shortly afterwards, the victim receives a Microsoft Teams call from someone claiming to be from IT support. During the call, the attacker encourages the user to allow remote access using legitimate tools such as AnyDesk or HopToDesk. Once connected, the attacker downloads an installer that deploys EtherRAT, a remote access trojan designed to give criminals long-term access to the device.

Why This Matters

This attack is particularly dangerous because it uses familiar tools and trusted communication channels. Microsoft Teams, remote support software and employee surveys are all common in everyday business life, which makes the scam feel believable.

Researchers have reported that affected users may see warning signs such as an external Teams contact labelled as unfamiliar, including examples such as “System Administrator (External unfamiliar)”. Teams audit logs may also show cross-tenant one-to-one chats initiated from attacker-controlled accounts.

What EtherRAT Can Do

EtherRAT is a remote access trojan that can run across Windows, macOS and Linux. Once installed, it can allow attackers to run commands, steal data, manipulate files and maintain access to a device.

One of the more unusual features of this malware is the way it finds its command-and-control server. Rather than relying only on a fixed address, it can retrieve connection details from an Ethereum smart contract, with a backup domain available if that fails. This makes it harder for defenders to disrupt.

What To Tell Your Team

• Be cautious of unexpected Microsoft Teams calls, especially from external or unfamiliar contacts.
• Do not grant remote control of your computer unless you are certain the request is genuine.
• Be suspicious of employee surveys or internal-looking emails that arrive unexpectedly.
• If someone claims to be from IT support, verify the request through your usual support route before taking action.
• Report anything suspicious immediately so it can be investigated quickly.

At IT Ambulance, we recommend reminding staff that genuine IT support should never pressure them into giving access without proper verification. If you receive an unexpected Teams call, email or remote access request, pause, check and report it. A quick check call to IT Ambulance could prevent a serious breach.

Talk to us to find out how our Advanced Threat Protection Package can help raise staff awareness with included periodic training to ensure they understand their obligations. This also ensures you are meeting your compliance requirements too.