Voice Phishing Attack - Microsoft Teams Support Call Compromise

What Happened

In a recent investigation by Microsoft’s Detection and Response Team (DART), a voice phishing attack using Microsoft Teams was uncovered. The incident began when a customer sought IT support in November 2025. A threat actor impersonated IT support, targeting multiple employees. After two failed attempts, they successfully convinced a third user to grant remote access via Quick Assist, leading to the compromise of a corporate device.

Once the attacker gained remote access, they shifted tactics. They guided the user to a malicious website where the user entered corporate credentials into a spoofed web form. This action initiated the download of malicious payloads. Among the first artifacts was a disguised Microsoft Installer (MSI) package that exploited trusted Windows mechanisms to sideload a malicious dynamic link library (DLL), establishing outbound command-and-control connections. This allowed the attacker to execute code under the guise of legitimate software.

Who's Being Targeted

The attack specifically targeted employees who were likely to respond to IT support requests. The nature of the attack relied on social engineering, exploiting the human instinct to be helpful and responsive. By impersonating trusted IT personnel, the attacker created a sense of urgency, which can easily override caution. This highlights a growing trend where threat actors leverage collaboration platforms like Microsoft Teams to gain initial access, rather than relying solely on software vulnerabilities.

Signs of Infection

Indicators of this type of attack include unusual remote access requests and prompts for corporate credentials via unexpected channels. In this case, evidence from browser history and Quick Assist artifacts revealed that the user had been directed to enter sensitive information into a fake web form. The presence of disguised MSI packages and subsequent malicious payloads indicated that the threat actor had established a foothold in the environment, enabling further exploitation.

How to Protect Yourself

To mitigate risks associated with such attacks, organizations must take proactive measures. DART recommends tightening external collaboration settings in Microsoft Teams. This includes restricting inbound communications from unmanaged accounts and implementing an allowlist model for trusted external domains. Additionally, reviewing the use of remote access tools like Quick Assist is crucial. Organizations should disable or remove unnecessary tools to limit potential attack vectors. These strategies can significantly reduce the chances of falling victim to identity-driven compromises, while still allowing employees to collaborate effectively.

By understanding the tactics used in this attack, organizations can better prepare themselves against future threats, ensuring that trust within their environments does not become a vulnerability.