Hackers Exploit Microsoft Teams’ Collaboration Features to Impersonate IT Helpdesk Staff

HomeCyber Security Hackers Exploit Microsoft Teams’ Collaboration Features to Impersonate IT Helpdesk Staff By Guru Baran May 29, 2026 A growing wave of vishing (voice phishing) campaigns in which threat actors abuse Microsoft Teams’ external collaboration features to impersonate IT helpdesk personnel and investigators is now turning to the Microsoft 365 Unified Audit Log (UAL) as a critical forensic data source to reconstruct attack timelines. The attack chain begins when a threat actor operating from an external or cross-tenant Teams account initiates an unsolicited call or message to a targeted employee, presenting as internal IT support. Using social engineering, the attacker convinces the victim to execute attacker-provided commands, approve remote access sessions, or install Remote Monitoring and Management (RMM) tooling such as Quick Assist. Because the interaction occurs within a seemingly trusted collaboration platform rather than email, traditional phishing defenses frequently fail to intercept the intrusion. Microsoft’s Detection and Response Team (DART) documented a campaign built on persistent Teams voice phishing as far back as November 2025, noting that the attack path has been observed across multiple enterprise environments. Black Basta ransomware affiliates were among the first documented threat actors to weaponize this technique at scale in 2024, combining Teams impersonation with credential theft via EvilProxy and SystemBC persistence tools. UAL as a Forensic Weapon Security researcher Maurice Fielenbach, currently investigating multiple active incidents, highlights the CallParticipantDetail operation logged under the MicrosoftTeams workload in the UAL as a pivotal artifact. This event records participant identity, join and leave timestamps, connection metadata, tenant of origin, and federated or external indicators. However, the precise schema varies by tenant and ingestion path, meaning analysts must validate field availability before building automated detections. Fielenbach cautions that ChatCreated is not a reliable Teams-client signal; its absence does not confirm that a chat never occurred. Audit records typically surface within 60 to 90 minutes with no guaranteed SLA, and default retention is 180 days. To reconstruct a complete attack timeline, investigators must correlate CallParticipantDetail with related events including MessageSent, MessageCreatedHasLink, and endpoint telemetry. For investigations requiring message body content, standard UAL queries are insufficient — Microsoft eDiscovery and Content Search workflows are required. Detection and Mitigation The following defensive measures are recommended for security teams: Restrict external Teams federation — limit cross-tenant communication to only users or groups with a documented business need. Triage first-contact external activity — treat any unsolicited external Teams call or message, especially when followed by URL sharing, Quick Assist launch, or script execution, as a potential vishing indicator. Leverage UAL for message and URL visibility — use Search-UnifiedAuditLog with -RecordType MicrosoftTeams and combine with endpoint telemetry for a full kill-chain view. Monitor enrichment signals — where available, review TeamsImpersonationDetected and SecurityRiskInCallDetected events as supplementary threat indicators. Block Quick Assist where unnecessary — remove or disable legacy remote access tools that lack modern authentication. Enforce out-of-band verification — train employees to confirm all IT support requests through a known internal channel before granting remote access. This attack class is significant because it exploits user trust in enterprise collaboration platforms rather than email, an attack surface many organizations have under-monitored. As Teams becomes a primary communication channel for hybrid workforces, the CallParticipantDetail log and correlated UAL artifacts are emerging as foundational evidence sources in incident response provided analysts understand their limitations and validate field schemas before operationalizing them in detection pipelines. Follow us on Google News, LinkedIn, and X to Get More Instant Updates. Tags cyber security cyber security news Copy URL Linkedin Twitter ReddIt Telegram Guru Baranhttps://cybersecuritynews.com Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments. Trending News Gitea Container Vulnerability Exposes Private Container Images to Attackers Hackers Use Fake ChatGPT and Claude Installers to Deploy DinDoor Backdoor Seedworm APT Abuses Signed Fortemedia and SentinelOne Binaries for DLL Sideloading Nginx-poolslip Vulnerability Enables DoS and Code Execution Attacks — Patch Now! Hackers Push 22 Versions of npm RAT With Wallet Theft and Persistent Backdoor Latest News Cyber Security News Hackers Use LLM Agent to Move From Marimo RCE to Internal Database in Four Pivots Cyber Security News VaultJacking Attack Steals Entire Google Password Manager Vault With One Captured PIN Cyber Security News AI-Generated npm Malware Accidentally Exposes Threat Actor’s Private GitHub Token Cyber Security News Claude Opus 4.8 Released With Ability to Work as an Experienced Engineer Cyber Security New Gogs 0-Day Vulnerability Lets Attackers Run Malicious Code on the Server Remotely