Attackers Impersonate IT Support in Microsoft Teams Phishing Campaigns

Threat actors are increasingly using Microsoft Teams chats to impersonate IT staff or trusted business contacts, persuading employees to approve MFA prompts, click malicious links, or hand over credentials. Palo Alto Networks Unit 42 said the tactic has appeared in multiple intrusions, including Cloaked Ursa/APT29 activity that used compromised accounts to send malicious Teams messages and UNC6692 operations that posed as helpdesk personnel to socially engineer targets through the platform.

The report said phishing delivered through collaboration tools is rising quickly, with Cortex telemetry showing such activity accounted for 42% of all phishing alerts in the first four months of 2026, up from 30% in the prior four-month period. Attackers are exploiting permissive Teams federation settings, unmanaged external accounts, typosquatted domains, and compromised partner tenants to appear legitimate, prompting defenders to tighten external communication controls, restrict federation to approved domains, disable unmanaged external access where possible, strengthen identity protections such as Conditional Access and Entra Privileged Identity Management, and monitor for suspicious external chat initiation.