Fake IT Support Scams Hit Nearly One in Three Organizations on Teams

Fake IT support operators targeted about 30 percent of organizations monitored by Ontinue during the first half of 2026, using Microsoft Teams calls to turn familiar workplace tools into an initial-access channel.

The managed security provider said successful compromises clustered around calls lasting roughly 20 minutes, suggesting patient social engineering rather than rapid scripted contact. One investigation led researchers to TWINLOOT, a Python implant whose command-and-control system operates through Microsoft 365 and Azure services.

The same report describes attackers hiding payload delivery inside other trusted infrastructure. Ontinue found that 1,568 malicious domains retrieved content from six blockchain smart contracts using EtherHiding. Its analysis of ClickFix activity also connected 6,188 delivery domains to only 158 payload hosts, concentrating the infrastructure behind a much larger set of lures.

For defenders, blocking a single display name or domain is unlikely to be enough. Organizations should restrict unsolicited external Teams contact where practical, teach employees to verify support requests through a separate channel, monitor remote-access tooling and investigate unusual use of cloud storage, device codes and collaboration infrastructure.