Rapid7 Guidance on Observed Microsoft Teams Phishing Campaigns

Rapid7 observed an increase in Microsoft Teams–based phishing campaigns where attackers spoof internal IT (e.g., “IT Support” or “System Admin”) to socially engineer users into launching Windows Quick Assist. The typical chain: mass spoofed chat requests from external accounts → active engagement posing as IT support → persuasion to start Quick Assist (granting remote control) → use of remote access to deploy malware, exfiltrate data, and perform lateral movement. The campaigns exploit collaboration-platform trust and the ability for external users to message internal staff (the subtle “Extern