Information as of 4 November 2026. A Teams call that appears to come from IT support may ask an employee to hand over control of a device. Identity checks and a clear support process help reduce the risk.
What happened?
In March 2026 Microsoft published an investigation into a customer incident. Attackers impersonated IT support and contacted multiple employees through Teams voice phishing. After gaining interactive remote access, they directed a user to a malicious website. Microsoft did not identify the customer.
What should staff look for?
Unexpected support calls, requests to install remote tools, sign in to unfamiliar sites or grant immediate access deserve verification. A Teams display name alone does not prove identity. Call back through a known internal number or established support channel.
Company checklist
Define approved support channels and remote tools, and tell employees how to verify support staff. Review Teams external contact settings and remote access permissions. Provide an easy way to report suspicious messages, and review sign-in and device activity regularly.
What if access was granted?
Stop the interaction and notify IT immediately. Follow the organisation's procedure for the device, sessions and credentials. Preserve messages and call times for investigation; the response should be decided by the responsible team.
Related services and reading
Discuss device, account and day-to-day IT support needs with Connet One. Explore managed IT services →
Read: the first hour of an IT incident