Microsoft Teams Phishing: Fake IT Support Targets Nearly a Third of Firms

Security firm Ontinue says about 30% of the organizations it monitors ran into at least one fake help-desk approach over Teams during the first six months of 2026, according to its 1H 2026 Threat Intelligence Report. The company published the findings on October 13, 2026, from Zürich. The pattern is simple: an outsider poses as your help desk and asks an employee to take a risky step.

If you run a small or growing company, this is a cash and operations issue, not only a technical one. A single compromised account can freeze payroll, delay orders, and trigger costly cleanup. Our primer on cybersecurity essentials covers the baseline habits that make these scams harder to pull off.

What the Report Found About Teams Impersonation

Ontinue measured how often outsiders pretended to be IT staff inside Microsoft Teams. The numbers below come from the company’s report, and they show how common the tactic has become.

One ratio looks small, yet it adds up. A company with thousands of external chats per month will see several suspicious contacts, and it only takes one employee to say yes.

Why Trust Beats Technical Skill

Ontinue’s director of advanced threat operations, Balazs Greksza, argues that most successful attacks lean on trust rather than clever exploits. That framing is useful for budgeting. You may get more protection from a clear verification habit than from another expensive tool.

Chat platforms feel internal, so employees relax. A message from a name that looks like “IT Help” gets a faster reply than a suspicious email. As a result, attackers use the platform’s friendly feel against you.

Consider the human side as well. A new hire, a busy manager, or a contractor unsure who runs IT is the likeliest target. These people want to be helpful and fast, and attackers know it. Build a culture where double-checking is praised, and where nobody feels foolish for asking whether a message is real.

Device-Code Phishing in Plain English

Device-code phishing tricks a person into entering a short code on a real Microsoft sign-in page. That approves the attacker’s session without needing the password. Across five of its customers’ environments, the firm verified ten successful takeovers during May and June.

The key point is that the sign-in page looks legitimate because it is. So training should teach one rule: never enter a code that someone else sent you unless you started the sign-in yourself. Meanwhile, ask your IT provider whether device-code sign-in can be limited in your setup. If an employee already entered a code they regret, they should tell IT immediately. Speed of reporting often decides how much damage follows, so make reporting free of blame.

A Three-Layer Framework for Small Teams

Here is a simple way to think about the response. Each layer costs little and removes a large share of the risk.

• People: Tell staff that real IT support will never ask for codes or remote access through an unsolicited chat.
• Process: Require a call-back to a known number for any request involving access, passwords, or payments.
• Platform: Restrict who outside your company can message your staff on Teams, and flag external senders clearly.

The Cybersecurity and Infrastructure Security Agency publishes free guidance on phishing and account protection that fits this approach. Assign one owner to review it each quarter.

Review the three layers at your next team meeting and give each one to a named person. Small companies often skip this step because everyone wears several hats, but unowned tasks rarely get done.

Budget the Cost of Doing Nothing

Treat a breach like any other operating risk. Estimate the days of lost work, the cost of outside help, and the customer trust you could lose. Then compare that figure with the price of training and tighter settings.

Testing your own defenses also pays off. Our report on AI penetration testing shows how smaller companies can find gaps before an attacker does.

What to Watch in the Months Ahead

The report also discusses supply-chain attacks, plus attackers using AI to go after open-source projects. Those threats reach you through the tools your developers install, not through chat. Ask your technical lead how new packages are reviewed. Patching speed matters too, as the Citrix NetScaler vulnerability story showed. Also watch how Microsoft and other platform vendors tighten settings for outside chats. Defaults tend to improve slowly, so your own configuration remains the main defense for now.

The practical step today is small. Send your team a two-sentence reminder about fake IT support, then schedule a short drill. Calm, repeated habits beat panic after the fact.