Microsoft says it observed approximately 141,000 malicious Microsoft Teams call attempts during Q3 2026. Attackers are increasingly using ordinary-looking personal names rather than obvious labels such as “IT Support” or “Help Desk”, while continuing to use Teams chat, voice calls, screen sharing and remote-support tools as part of social-engineering attacks.
That does not mean 141,000 businesses were compromised. Microsoft says the figure includes unanswered, rejected and short-lived calls. The important point for businesses is that attackers are deliberately moving into the same collaboration tools staff use every day, where an unexpected message or call can feel more trustworthy than a suspicious email.
What did Microsoft find?
Microsoft Threat Intelligence says malicious Teams call activity peaked in July 2026 before falling later in the quarter. Even after that decline, September remained above the average monthly level seen in the first half of the year.
The way attackers presented themselves also changed. In Microsoft’s observed sample, ordinary personal-name display names increased from 46% in July to 88% in September, while explicit help-desk identities fell sharply.
This matters because staff may have been trained to question a call from someone named “IT Support”, but may be less suspicious of a normal-looking name such as “James Carter” or “Sarah Williams”. A familiar-looking identity is not proof that the person is genuine.
How can a malicious Teams call lead to a compromise?
The call itself is often only the first step. Microsoft has documented campaigns where attackers contact users through Teams, impersonate support staff and then persuade the user to grant remote access to their computer.
That can involve asking the user to:
- share their screen;
- approve a request for remote control;
- open Windows Quick Assist or another remote-support tool;
- read out a connection code;
- visit a website supplied during the conversation;
- enter Microsoft 365 credentials into a fake sign-in page; or
- approve an unexpected authentication request.
In one campaign described by Microsoft, once remote access was granted the attackers used PowerShell and other legitimate Windows components to establish further access and begin reconnaissance inside the victim’s environment.
This is social engineering rather than a weakness that automatically lets an attacker break into Teams. The attacker still needs the user to trust the request or take an action.
Why are attackers moving beyond email?
Email security has improved significantly, and users are more accustomed to looking for phishing emails. Teams can provide attackers with a different route into the same organisation.
A live call can create urgency and pressure. The attacker can respond immediately to questions, change their story and guide the user through each step. Teams also feels like an internal business tool, so a request arriving there may receive less scrutiny than an unexpected email.
Microsoft says these attacks have used live interactions across chat, voice, screen sharing and remote-support tools to pursue credential theft, remote access and hands-on-keyboard compromise.
What should staff do with an unexpected Teams support call?
The safest approach is simple: verify the caller through a channel you already trust before granting access or sharing anything sensitive.
- Do not rely on the displayed name. A normal personal name does not prove who is behind the account.
- Do not share passwords or MFA codes. Genuine support staff should not need you to disclose them.
- Do not approve unexpected remote-control requests. If someone wants access to your screen or computer, verify them first.
- Use your normal support route. End the call and contact your IT provider using a saved number, known email address or established ticketing system.
- Treat urgency as a warning sign. Claims that an account will be locked immediately should not bypass your normal verification process.
- Report suspicious contact. Keep the Teams message or call details available so your IT or security team can investigate.
Does Microsoft Teams already have protection against this?
Microsoft is adding more protections against impersonation and suspicious activity in Teams, including warnings around potentially deceptive meeting identities. KES recently covered the forthcoming Teams meeting impersonation protection feature.
Those controls are useful, but they should support rather than replace staff awareness. Microsoft notes that legitimate callers can sometimes be flagged and, equally, the absence of a warning does not prove a caller is safe.
For businesses, the strongest defence is a combination of appropriate Microsoft 365 security controls, sensible external-collaboration settings and a clear process that tells staff exactly how to verify an unexpected support request.
What should a business check now?
- Tell staff that Teams can be used for phishing and vishing. Do not focus security awareness only on email.
- Define how genuine IT support will contact users. Staff should know what your support team will and will not ask them to do.
- Make verification easy. Give staff a known phone number, support email address or ticketing route they can use to check an unexpected request.
- Review external Teams access. Make sure your collaboration settings reflect how the business actually works with customers, suppliers and other organisations.
- Review remote-support tools. Know which tools are approved and who is authorised to use them.
- Keep Microsoft 365 and endpoint security monitored. A suspicious call should be treated as part of a wider security event if the user clicked a link, entered credentials or granted remote access.
If a member of staff has already granted remote access, entered credentials or approved an unexpected authentication request, contact your IT or security team immediately rather than waiting to see whether anything happens.
Quick answers
Were there really 141,000 successful Teams attacks?
No. Microsoft says it observed approximately 141,000 malicious Teams call attempts during Q3 2026. The total includes calls that were unanswered, rejected or ended quickly.
Are attackers still pretending to be IT support?
Yes, but they are increasingly using ordinary personal display names rather than obvious names such as “Help Desk”. The story they tell during the conversation may still involve IT support.
Should staff accept a Teams call from an external person?
External Teams calls can be completely legitimate. The important point is to independently verify any unusual request involving passwords, authentication, sensitive data, payments or remote access.
What should I do if I think I spoke to an attacker?
Stop the interaction, disconnect any remote-access session and contact your IT or security provider through a trusted route. Explain what happened and whether you entered credentials, approved authentication or allowed control of the computer.
Sources
- Microsoft Security Blog: Email threat landscape — Q3 2026 trends and insights
- Microsoft Security Blog: Impersonating IT support — how threat actors turn a remote session into enterprise-wide access
Information checked 9 November 2026. Threat activity and Microsoft security controls continue to change, so organisations should review current Microsoft guidance and their own tenant settings.
