Fake IT support on Teams: close the gaps in your service desk

On 30 October, Microsoft published an account of two intrusions that began with someone pretending to be the IT help desk. The attackers contacted employees through Teams messages and calls, then talked them into opening a remote session, primarily through Quick Assist. Microsoft says the attackers relied on social engineering and weak settings in Active Directory Certificate Services (AD CS), the Windows role that issues internal certificates, and exploited no Teams vulnerability.

We read the report as a service management problem because the forged item was the service desk itself. The people who run IT support decide how a genuine support contact looks and how staff can check one.

What happened in the two intrusions

One intrusion began with Teams contact aimed at three users, which compromised one workstation. The attacker used a badly configured certificate template to obtain certificates for three highly privileged accounts. About 90 minutes later, a larger wave targeted 16 users, compromised another workstation and yielded certificates for eight more privileged accounts. Microsoft Defender's automated containment restricted the accounts it covered and blocked more than 1,000 later file-access attempts. One privileged account had been excluded from automated response, and the attacker used that account to reach a file server and copy data to an external SFTP destination. Microsoft's summary of the lesson is that "exclusions can preserve the attacker's path."

The other intrusion met no such template weakness. The attacker forced a domain controller to authenticate to an attacker-controlled system, then relayed that login to the AD CS web enrolment service and obtained a certificate as the domain controller. Defender raised alerts, the customer isolated the workstation, and Microsoft saw no further progress. GBHackers' report gives the same figures.

Microsoft doesn't name the organisations, sectors or regions involved, and it hasn't attributed the activity to a known group. How often the technique is reaching NZ or Australian organisations is unknown.

Why the service desk owns part of the fix

Quick Assist has very little identity checking built in. Microsoft's documentation says no roles, permissions or policies are involved, the person sharing their screen doesn't authenticate, and that person sees only the helper's first name and last initial. Teams adds exposure, because all external domains are allowed by default. In these cases the attackers reportedly used support-style display names and tenant names mimicking their targets.

Microsoft's advice to users is to refuse anyone claiming to be IT support unless the user started the interaction. A service desk that cold-contacts staff about a patch or a device fault and asks them to open a remote tool is teaching the behaviour these attackers rely on. The remedy belongs in the service desk and service request practices described in ITIL. A remote session should be a logged step in a request, and the employee should have a way to check that request independently.

Incident handling needs the same attention. Microsoft warns that revoking a certificate doesn't invalidate Kerberos tickets already issued, and password resets and reimaging don't revoke issued certificates. A major incident runbook built around resetting a password and rebuilding a laptop could leave the attacker's access in place. Microsoft also says containment exclusions should be treated as incident decisions. We'd go further and give every exclusion a named owner and a review date in a change record, because the excluded account in the larger intrusion became the route to the data.

What it means for NZ organisations

New Zealand's National Cyber Security Centre said in its Q2 2025 insights that it knew of helpdesk techniques being used to infiltrate a number of NZ organisations. The NCSC's warning covered attackers phoning the desk and posing as staff, while Microsoft's cases run the other way, with the attacker posing as the desk and contacting staff. Both routes exploit weak proof of identity between employees and support, so verification rules need to cover contact in each direction.

The NCSC's latest quarterly figures show 1,129 incident reports and $2.7 million in reported direct losses for April to June 2026. Unauthorised access incidents accounted for about $1.3 million of those losses. The summary doesn't say how many involved help desk impersonation.

Outsourced support raises the risk for many mid-sized firms. Staff at an organisation using a managed service provider may not know their technicians by name, so a stranger introducing themselves as IT support seems ordinary. The NCSC also advises assessing the access given to managed service providers, since providers can be targeted too.

Older Windows environments carry the other risk. We'd expect AD CS to go unreviewed in many organisations once wifi or VPN certificates are working, which is how a risky template survives for years. Cloud-only organisations without AD CS avoid that escalation path, although a remote session on a staff laptop still exposes whatever the user can reach.

Next steps

• Write a contact rule for the desk. No remote session starts without a ticket number the employee can see in the service portal. Anyone contacted without one ends the conversation and checks through a known internal channel.
• Tell all staff what the rule is. A short message from the IT lead, repeated in onboarding, works better when it describes this exact approach: a Teams call from "IT support" asking for a code.
• Choose one approved remote support tool. Intune Remote Help requires both parties to sign in with an account from your organisation and records who helped whom. If you adopt it, uninstall Quick Assist, because blocking the Quick Assist endpoint also disrupts Remote Help.
• Review Teams external access. Turning off unmanaged accounts won't stop a licensed lookalike tenant, so consider allowing only specific external domains. The cost is an allow list that someone has to maintain for suppliers and clients.
• Question your managed service provider. Ask how their technicians identify themselves, which remote tools they use and what privileged access they hold.
• Have AD CS reviewed. Check templates for requester-supplied identity and broad enrolment rights, and remove web enrolment endpoints you don't need. Where the endpoints stay, apply HTTPS and Extended Protection.
• Update the major incident runbook. Add certificate revocation, a separate review of Kerberos sessions, and a check for accounts excluded from automated containment.

The contact rule costs very little and can go live within a week or two. AD CS changes need testing and a change window, so raise that change now if your organisation freezes changes over the Christmas period.