Fake Helpdesk Attack Uses Teams and Quick Assist to Breach Targets

Attackers are increasingly abusing Microsoft Teams and Windows Quick Assist to run a helpdesk‑themed social engineering attack chain that leads to full enterprise compromise and stealthy data theft.

By impersonating IT support and relying on legitimate tools and protocols, adversaries can move laterally and exfiltrate data while blending into normal admin activity.

Using names such as “Help Desk” or “IT Support,” they exploit external collaboration features to make their outreach appear to be routine support rather than traditional phishing.

Teams’ built‑in defenses external labels, Accept/Block prompts, and spam/phishing banners are present, but the attack hinges on convincing the user to ignore those warnings.

Voice phishing is often layered on top of chat to increase urgency and push victims into following instructions without verifying the caller’s identity.

In recent campaigns, threat actors initiate cross‑tenant Microsoft Teams chats and calls while posing as internal IT or helpdesk staff.

This immediately gives the threat actor interactive remote control of the workstation under the guise of troubleshooting a problem.

Once rapport is established, the attacker instructs the user to start a Quick Assist session, enter a short code, and approve all elevation prompts.

From Quick Assist to stealthy execution

After gaining access, attackers spend the first minute or two running commands such as cmd.exe and PowerShell to confirm user privileges, domain membership, and network reachability.

If the host is sufficiently privileged, they then drop small staging bundles into locations like ProgramData and use DLL sideloading through trusted, vendor‑signed binaries to run attacker‑supplied modules.

External Accept/Block screens provide notice to users about First Contact events, which prompt the user to inspect the sender’s identity before accepting.

Observed loaders include update‑ or security‑themed executables that load malicious DLLs from non‑standard paths, allowing code to execute under a trusted process name.

Attackers also write large encoded values into user‑context registry locations to store encrypted configuration data, which a sideloaded module later decrypts in memory.

This file‑light approach mirrors modern intrusion frameworks that keep command‑and‑control (C2) settings in the registry to survive restarts and some remediation actions.

Outbound HTTPS connections over port 443 then establish C2 from the hijacked updater‑style process to cloud‑hosted infrastructure, masquerading as normal web traffic.

With a working implant, threat actors pivot inside the network using native Windows Remote Management (WinRM) over TCP 5985 to reach additional domain‑joined systems.

Microsoft has observed credential‑backed lateral movement from these user‑initiated sessions toward identity‑centric assets, including domain controllers and other high‑value infrastructure.

Safe Links for time-of-click protection warns users when URLs from Teams chat messages are malicious.

To extend control, adversaries remotely deploy commercial remote management tools through msiexec, giving themselves a persistent secondary channel that looks like standard IT software.

For data theft, actors rely on utilities such as Rclone to synchronize selected business documents to external cloud storage.

Transfer filters are often tuned to exclude noisy file types while focusing on business‑relevant data, reducing both volume and detection likelihood.

Because every step uses legitimate apps and admin protocols Teams, Quick Assist, signed binaries, WinRM, commercial RMM, and cloud sync the intrusion closely resembles routine support activity from end to end.

Risk and defensive guidance

This attack chain significantly raises risk for enterprises that rely heavily on Teams and remote support, as it sidesteps email‑centric phishing controls and abuses user trust in internal helpdesk workflows.

On systems with limited privileges such as kiosks, VDI, or non-corp-joined devices actors might pause without deploying payloads, leaving only brief reconnaissance activity. 

Effective mitigation requires tightening external collaboration policies, restricting who can initiate remote assistance, and hardening endpoints against DLL sideloading and unapproved remote tools.

Microsoft recommends enabling Safe Links and Zero‑hour Auto Purge (ZAP) for Teams, enforcing Conditional Access with MFA for privileged roles, limiting WinRM to authorized admin workstations, and monitoring for tools like Rclone via hunting and custom detections.

User education remains critical: organizations should clearly explain how genuine IT will contact staff, how to recognize external tenants and warning banners in Teams, and why unsolicited remote assistance requests should be treated as suspicious and reported to security teams.

Microsoft Defender’s correlated telemetry across identity, endpoint, and collaboration platforms can then help detect and disrupt this user‑initiated access path before it escalates into a full‑scale compromise.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.