Microsoft Teams Helpdesk Lures Still Reach Domain Controllers

Microsoft Threat Intelligence said on September 2, 2026 that operators still impersonate IT staff in Microsoft Teams, then ride a live remote session toward domain controllers. The first step is an external chat or call. The second is a worker who grants control through Quick Assist or a Teams screen share.

That sequence is not new. Storm-1811 used it in 2024 on the way to Black Basta. DART walked the same path in a November 2025 case. The unpaid bill is the default settings that still let the first ping through.

Storm-1811 Wrote This Playbook in 2024

Microsoft Threat Intelligence first tied financially motivated Storm-1811 to Quick Assist in mid-April 2024. The group is known for Black Basta, a closed ransomware offering that first showed up in April 2022. The early pattern was a voice call from “IT,” then a six-digit Quick Assist code, then scripts, RMM tools, and ransomware.

A June 2024 update on that same write-up recorded the move onto Teams at the end of May 2024. Actor-owned tenants called users with display names such as Help Desk, Help Desk IT, Help Desk Support, and IT Support. After the session, operators stole credentials with EvilProxy and left SystemBC for persistence. That is the Quick Assist path into Black Basta that later crews still copy.

CISA’s Black Basta advisory caught the same shift. An update dated November 8, 2024 said affiliates had added email bombing then Teams contact, posing as technical support to clear a mailbox that they had just flooded. Microsoft said it suspended identified accounts and tenants tied to that inauthentic behavior. The method did not retire with those tenants.

HOW THE HELPDESK LURE GREW

1. April 2022: Black Basta first appears as a closed ransomware offering used by a small set of operators.
2. Mid-April 2024: Microsoft tracks Storm-1811 misusing Quick Assist after vishing calls that impersonate IT or help desk staff.
3. End of May 2024: The same group starts messaging and calling targets in Teams from actor-owned tenants.
4. November 8, 2024: CISA updates AA24-131a to include Teams messages after email bombing.
5. November 2025: A customer calls DART; investigators find persistent Teams vishing across multiple employees.
6. September 2, 2026: Microsoft Threat Intelligence publishes a live campaign that still opens on an external Teams helpdesk lure, then pivots inside the network.

From the May 15, 2024 Quick Assist post to the September 2, 2026 campaign note is 840 days. The contact path barely moved. The payload after the session got quieter and closer to identity systems.

What a Fake IT Session Does on the Desktop

DART’s eighth Cyberattack Series case started when a customer asked for help in November 2025. The operator impersonated IT support on Teams voice calls, failed with two employees, and succeeded with a third who launched Quick Assist. Browser history and Quick Assist artifacts showed a spoofed web form for corporate credentials, then a disguised MSI that sideloaded a DLL and opened command-and-control.

Following two failed attempts, the threat actor ultimately convinced a third user to grant remote access through Quick Assist, enabling the initial compromise of a corporate device.

Microsoft Detection and Response Team, Cyberattack Series No. 8, March 16, 2026

DART said that intrusion was short-lived and limited, with no persistence left behind after eviction. The September 2, 2026 campaign Microsoft Threat Intelligence described does not stop at a foothold. Mapped as T1566.003 (spearphishing via service), it treats the remote session as a launch pad for silent software and then for the domain.

During the session the operator runs PowerShell, pulls an MSI from cloud storage, and installs it with msiexec using /qn so no wizard appears. Names look like hotfixes. The package stages a portable Node.js runtime from the official Node.js distribution under LocalAppData, plus an encrypted JavaScript implant. Persistence showed up as an EdgeUpdate Run value or a Startup shortcut that relaunches the loader at sign-in.

Tasking over randomized HTTPS polling captured the desktop, queried antivirus and display adapters, and enumerated Active Directory. Follow-on DLLs ran through rundll32. Operator tasking then opened WinRM toward domain controllers and certificate authorities on TCP port 5985. Recovered implants also held dormant code to fetch a new C2 URL from an Ethereum smart contract; that path was switched off in the builds Microsoft analyzed, which used a hard-coded fallback instead.

TWO YEARS OF THE SAME DOOR

Lures in the 2026 write-up included Microsoft Security Update, Spam Filter Update, and Account Verification, plus tasks to stop an account being deactivated. Voice is sometimes layered so the harmful instructions never hit the chat transcript at all.

External Access Is Still Allowed by Default

Microsoft is clear that this chain is social engineering, not a Teams exploit. The September 2, 2026 analysis says the operator has to talk the user past external-tenant labels, Accept/Block prompts, message previews, and phishing indicators. Those prompts only appear if the inbound path is open in the first place.

On Microsoft Learn, both the organization setting and the user policies for external access are turned on by default. For meetings and chat with other Microsoft 365 organizations, all external domains are allowed unless an admin builds an allow list or a block list. The other side must also trust your domain, which is a low bar for an attacker who owns the far tenant.

Admins can switch to allow-only, block-only, or block-all. A separate switch can block named people, with a cap of 200 addresses, and that list is off until someone turns it on. AllowedDomains can hold up to 4,000 entries, but only if AllowFederatedUsers stays true; that flag is the master switch, and its default is true.

Federation with trial-only tenants is blocked by default, a change Microsoft pushed in 2024 after cheap onmicrosoft.com helpdesk tenants became a cliché. Paid tenants and custom domains still federate. New PowerShell controls named EnableExternalAccessRestrictionsForChatParticipants and EnableMutualFederationForChatParticipants began rolling out from July to September 2026. Both are disabled by default, so a tenant that never opts in keeps the old group-chat holes.

Quick Assist Arrives With Windows 11

Quick Assist is not a shadow IT download. Microsoft says it is installed by default on Windows 11. The helper sends a short code. The target presses CTRL + Windows + Q, types the code, allows screen sharing, then accepts Request Control. After that, the helper has a full desktop, including the prompt to run an installer.

Microsoft has recommended since the 2024 Storm-1811 post that organizations uninstall Quick Assist from Windows if they do not use it, and consider Intune Remote Help when remote support has to stay inside one Entra tenant. Learn lists two official kills: block https://remoteassistance.support.services.microsoft.com, or remove the Appx package MicrosoftCorporationII.QuickAssist for all users. Blocking the endpoint also breaks Remote Help, because that product uses the same address.

Helpdesk impersonation on Teams does not require Quick Assist. Microsoft’s 2026 chain lists a second grant path: approving request control during a Teams screen share. Defenders who only delete Quick Assist and leave external screen sharing untouched have closed the famous door and left the one next to it.

Call Logs Show Up After the Operator Is In

Security researcher Maurice Fielenbach, who has been working several live incidents, points investigators at CallParticipantDetail under the MicrosoftTeams workload in the Unified Audit Log. That record can carry participant identity, join and leave times, connection metadata, tenant of origin, and federated or external flags. The schema is not identical in every tenant, so detections copied from a lab tenant fail in production without a field check.

He also warns that a missing ChatCreated event does not prove a chat never happened. Standard UAL searches do not return message bodies; those sit in eDiscovery and Content Search. Voice instructions, which Microsoft says operators use to keep URLs out of chat, never land in either place.

WHAT THE AUDIT LOG WILL AND WILL NOT GIVE YOU

• Arrival delay: Audit records typically surface within 60 to 90 minutes, with no guaranteed SLA, so a live vishing call is over before the row exists.
• Default keep time: Audit (Standard) retains records for 180 days; logs from before October 17, 2023 followed a 90-day keep.
• E5 exception: Audit (Premium) keeps Entra ID, Exchange, and SharePoint activity for 1 year by default, while other workloads, including Teams, still default to 180 days unless a retention policy extends them.
• Bodies and voice: Message text needs eDiscovery; spoken helpdesk instructions are not in UAL at all.

Fielenbach’s working method is to join CallParticipantDetail with MessageSent, MessageCreatedHasLink, and endpoint telemetry. Search-UnifiedAuditLog with -RecordType MicrosoftTeams is the usual pull. Where they exist, TeamsImpersonationDetected and SecurityRiskInCallDetected are extra signals, not a complete tripwire. The log reconstructs the call. It does not interrupt it.

Screen Sharing Inside Teams Needs No Extra Tool

The install step is the first moment a control can refuse the chain, because Quick Assist, AnyDesk, or an MSI has to appear on disk. Some operators skip that step. They stay inside Teams, share the screen, and ask for control on a feature the company already blessed for collaboration. There is nothing new to blocklist at the access stage if the product’s own remote-control prompt is the grant.

Once hands are on the keyboard, the next reliable tell is PowerShell or cmd.exe on that same desktop, often followed by Invoke-WebRequest or msiexec pulling a package from cloud storage. Application control or PowerShell constraints fail that download even when the helpdesk theater was perfect. Hunt queries Microsoft published with the September 2, 2026 post start at external Teams senders and thread IDs, then look for that remote-assist process tree sitting next to a script host.

Defender for Cloud Apps and Defender for Office 365 titles that Microsoft listed for this pattern include a Teams chat from a suspicious external user, IT support Teams voice phishing after mail bombing, and a click through to a malicious URL. Alert names vary by product version. They still assume someone is watching the first external touch, which many tenants treat as normal partner chat.

Allowlists and a Callback Beat a Live Call

DART’s advice after the November 2025 case was blunt: restrict inbound Teams traffic from unmanaged accounts, put trusted partner domains on an allow list, inventory remote support tools, and remove Quick Assist where it is not required. Microsoft Threat Intelligence’s later campaign note adds the same first-contact hygiene and then the post-session hunt, because a granted desktop is already a credential-backed session.

CONTROLS THAT CUT THE PATH

• Federation allow list: Set Teams external access to allow only named partner domains, and turn the org-wide default off so random tenants cannot search and ring users.
• Trial and display names: Keep ExternalAccessWithTrialTenants at Blocked, and treat Help Desk-style display names from another tenant as hostile until a ticket matches.
• Quick Assist removal: Uninstall the Appx package on Windows 11 estates that already have Intune Remote Help or another managed tool, and do not confuse that with the old msra.exe Remote Assistance policy, which does not govern Quick Assist.
• Teams request control: Limit who can present and take control in meetings, and treat an unsolicited screen-share from an external account as an incident, not a courtesy.
• Out-of-band check: Train staff to call the real helpdesk on a known number before typing a Quick Assist code or approving request control, even when the Teams window looks internal.
• After the grant: Alert on Quick Assist or Teams sharing followed by msiexec, Node.js under LocalAppData, an EdgeUpdate Run key, or WinRM from a user workstation to a domain controller on TCP port 5985.

Employees are trained to be helpful when IT calls, and hybrid work made Teams the place that call now happens. Microsoft’s own prompts try to mark the stranger. They cannot finish the job while the tenant still accepts every federated domain and ships a remote-control app with the operating system.

The July to September 2026 federation switches give admins a tighter group-chat rule, and they do nothing until someone sets them to true. Until that change, the helpdesk lure that Storm-1811 ran in 2024 is still a supported workflow for anyone who can open an external tenant and sound like support.