Rapid7 Guidance on Observed Microsoft Teams Phishing Campaigns

Rapid7 observed an uptick in phishing campaigns delivered via Microsoft Teams in which threat actors impersonate internal IT (e.g., “IT Support”) to socially engineer users into launching Windows Quick Assist and granting remote access. Attack flow: spoofed external Teams chat requests → engagement and impersonation of IT → persuasion to start Quick Assist (or similar remote-assistance) → remote control used to deploy malware, exfiltrate data, or enable lateral movement. The campaigns exploit Teams’ default ability to accept messages from external users and users’ implicit trust of internal-se