The Microsoft Teams IT Support Scam — What Calgary Businesses Need to Know Right Now
A New Kind of Attack — And It's Working
For years, security training has focused on one thing: don't click suspicious links in email. Check the sender address. Watch for strange attachments. Don't enter your password into a page you clicked to from email.
Attackers noticed. And they found a way around all of it.
A fast-growing wave of cyberattacks is now targeting Canadian businesses through Microsoft Teams — not email. Attackers call or message employees directly on Teams, impersonating IT support staff, and use conversation, urgency, and trust to convince people to hand over access to their systems. Once inside, ransomware deployment or data theft typically follows within hours.
This isn't a theoretical threat. Palo Alto Networks' Unit 42 documented a coordinated campaign called Spring Ring, active from January through April 2026, that targeted more than 150 employees across at least 10 organizations. Sophos uncovered a related campaign in which 50% of targeted organizations were based in Canada — and ransomware was deployed in some cases within just 17 hours of the initial Teams contact.
If your employees use Microsoft Teams, they need to know about this scam. Share this post with your team today.
How the Attack Unfolds — Step by Step
The attack follows a consistent pattern. Understanding the steps is the first line of defense.
Step 1 — The Email Bomb
The attack begins before Teams is involved. The employee's inbox is suddenly flooded with dozens — sometimes hundreds — of emails in a short window. Newsletter sign-ups, subscription confirmations, junk notifications. This is deliberate and calculated: it overwhelms the inbox, creates a sense that something is wrong, and primes the employee to believe they need IT help.
This technique is called email bombing, and it is specifically designed to set the stage for what comes next.
Step 2 — The Teams Call or Message
Within minutes of the email flood, a Microsoft Teams message or call arrives. The sender presents themselves as IT support, the help desk, or in some cases Microsoft itself. They say they've detected suspicious activity on the account, that the computer may be compromised, or that a security update is urgently needed.
The Teams account appears convincing. Attackers create profiles with names like "IT SUPPORT," "Help Desk 24/7," or "Microsoft Security Team" — sometimes adding checkmark emojis to appear verified. The message arrives inside Teams, not email, which is exactly why employees trust it. Teams feels like an internal tool.
There's one important technical detail: Teams will show a small warning that the sender is external to your organization. But that warning is easy to miss, especially when someone is already anxious about a suspected security problem.
Step 3 — The Request for Access
The attacker, now posing as helpful IT support, moves the conversation toward one goal: gaining remote access to the device. They typically ask the employee to:
• Open Quick Assist or another remote management tool and share an access code
• Approve a multi-factor authentication (MFA) prompt
• Download a file or run a command they provide
• Share their screen so "IT" can diagnose the problem
Each of these actions, if taken, gives the attacker direct control of the device — or at minimum, access to critical accounts.
Step 4 — Ransomware or Data Theft
Once remote access is established, the attacker moves quickly. In documented cases, the time between initial Teams contact and ransomware deployment was as short as 17 hours. Data exfiltration — stealing files, credentials, and sensitive information — often happens simultaneously, creating leverage for double extortion: pay to restore your files, and pay again to prevent us from publishing what we took.
Why This Scam Is So Effective
Traditional phishing training teaches employees to be suspicious of email. This attack sidesteps email entirely — and it exploits several psychological factors that make it unusually effective.
It uses a trusted platform. Microsoft Teams is an internal work tool. Employees associate it with colleagues and legitimate communication, not attackers. That assumption of trust is exactly what the scam exploits.
The email bomb creates genuine anxiety. The inbox flood happens first for a reason. By the time the Teams call arrives, the employee genuinely believes something is wrong and is actively looking for help. The attacker's offer to fix the problem arrives at precisely the right psychological moment.
It's a real conversation, not a click. Unlike an email phishing link, this attack involves a live conversation. The attacker can answer questions, reassure doubts, and adapt in real time. Conversational manipulation is far more effective than a static link — and far harder to train against.
Urgency bypasses rational thinking. The attacker stresses that the situation is urgent and time-sensitive. Urgency is one of the most reliable tools in social engineering — it pushes people to act before they think. And if the employee is already anxious from the email flood, urgency works even better.
It looks like legitimate IT support. A real IT helpdesk call involves exactly the same things: someone calling to report a problem, asking to verify your identity, requesting remote access to fix an issue. The attack mirrors legitimate IT support almost perfectly.
The Scale of the Threat — What the Research Shows
This isn't a niche or emerging threat. Multiple security firms have documented active campaigns targeting North American businesses through Teams impersonation in 2025 and 2026:
• Spring Ring (Palo Alto Networks Unit 42, 2026): A coordinated operation using external Teams accounts to impersonate IT helpdesk staff. Targeted more than 150 employees across at least 10 organizations. Analysts identified 26 distinct attacker identities behind the operation.
• STAC4749 (Sophos, 2025): A vishing campaign targeting dozens of organizations between February and June 2025. 50% of targeted organizations were based in Canada. In at least one case, attackers deployed Chaos ransomware within 17 hours of the initial Teams contact.
• UNC6692 (Mandiant, December 2025): A threat group that used Teams to impersonate IT helpdesk staff, convincing targeted employees to accept Teams chat invitations from outside their organization before moving to credential harvesting.
• Cloaked Ursa / APT29: A Russian state-sponsored group that operationalized Teams-based social engineering, using compromised accounts to send Teams messages containing malicious links redirecting to credential harvesting pages.
The industries targeted span services, manufacturing, energy, construction, and legal — with energy companies specifically named as a high-value target sector. For Calgary's oil and gas community, this threat is directly relevant.
How to Protect Your Calgary Business — 6 Specific Steps
The good news is that this attack is preventable. Here are the six most effective steps your organization should take right now.
1. Tell Your Team About This Scam — Today
The single most effective defense against this attack is awareness. Send an email to your entire team, hold a brief team meeting, or share this post directly. Employees who know this scam exists and understand how it works are dramatically less likely to fall for it. The attack relies entirely on the target not recognizing what's happening.
Key message to communicate: Your IT team will never call you on Teams out of nowhere and ask for remote access, screen sharing, or MFA approval. If this happens, it is a scam.
2. Establish a Simple IT Verification Protocol
Create a one-sentence rule your entire team can remember: before granting remote access to anyone claiming to be IT support — regardless of what platform they contact you on — hang up or end the chat and call your IT provider back on their known number.
This single step stops the attack dead. Even a 60-second verification call breaks the attacker's momentum and exposes the impersonation. Make this a formal policy, not just a suggestion.
3. Configure Microsoft Teams External Access Settings
In Microsoft 365 admin settings, IT administrators can restrict or disable the ability for external Teams accounts to initiate chats or calls with your users. If your organization doesn't have a legitimate business reason to receive unsolicited Teams communications from external organizations, restricting this setting eliminates the primary attack vector. This is a technical control that Microsoft specifically recommends for defending against Teams-based vishing.
4. Train Employees to Recognize the Email Bomb Signal
The email flood that precedes the Teams call is a reliable early warning signal. Train employees that if their inbox is suddenly flooded with junk emails and then they receive an unexpected call or message from someone claiming to be IT, they should immediately be on alert — not reassured. The email flood is the setup, not the problem. The call is the attack.
5. Never Use Quick Assist or Grant Remote Access to an Unsolicited Caller
Quick Assist is a legitimate Microsoft tool that IT professionals use for remote support — and it's a primary target for this attack. Establish a clear policy: Quick Assist and any other remote access tools are only used at your organization's initiative, through a support ticket or scheduled session with your IT provider. Any unsolicited request to open Quick Assist — regardless of what platform it comes through — is an attack.
6. Implement Security Awareness Training and Vishing Simulations
One-time awareness communication isn't enough. Regular security awareness training that specifically covers social engineering, vishing, and Teams-based attacks builds the organizational muscle memory needed to recognize and respond to these threats in the moment. Simulated vishing exercises — where your IT provider tests employees with realistic attack scenarios — are particularly effective at identifying who needs additional training before a real attacker finds them first.
What to Do If Your Organization Is Targeted
If an employee receives a suspicious Teams message or call matching this pattern — or if someone has already granted access — act immediately:
1. End the Teams call or chat immediately. Do not continue the conversation.
2. Do not grant remote access, approve MFA prompts, or share your screen. If access has already been granted, disconnect from the network right away.
3. Call your IT provider directly on their known number. Not through Teams, not by replying to the message. Use a number you already have on file.
4. If remote access was granted, isolate the device immediately. Disconnect from Wi-Fi and the network. Do not use the device until your IT team has assessed it.
5. Document what happened. Screenshot the Teams account that contacted you, note the time, and save any chat messages — your IT team will need this for incident response.
6. Alert your colleagues. If attackers are targeting your organization, other employees may receive similar messages. Get the word out quickly.
West Wolf IT Can Help Protect Your Calgary Business
The Microsoft Teams IT support scam is active, targeting Canadian businesses right now, and evolving quickly. The organizations that avoid becoming victims are the ones whose employees know what to look for and whose IT environments are configured to minimize the attack surface.
West Wolf IT Solutions helps Calgary businesses protect themselves from exactly these kinds of social engineering attacks — through security awareness training, Microsoft 365 security configuration, vishing simulations, and 24/7 monitoring that detects suspicious activity before it becomes a breach.
Don't wait for one of your employees to get that Teams call. Get ahead of this threat now.
Comments