The ‘IT Help Desk’ Messaging You on Teams Isn’t Yours

First the Flood, Then the Friendly Message

Picture your bookkeeper getting into work on a Monday. Their inbox is going nuts. Hundreds of newsletter signups, account confirmations, and emails in languages they don’t read. It keeps coming faster than they can delete it. Real client email is buried somewhere in there.

Twenty minutes later a Microsoft Teams message pops up. The name says IT Help Desk. Maybe there’s a little Microsoft logo as the profile picture.

Hi, we’re seeing a spam attack on your mailbox. We can clean it up for you. Can you accept a quick screen share?

It feels like a rescue. It’s the actual attack.

How the Scam Works

Step 1: The email bomb

The attacker uses automated tools to sign your email address up for hundreds or thousands of mailing lists at once. Nobody hacked anything yet. It’s just noise. But it’s stressful noise, and stressed people make quick decisions.

Step 2: The Teams message

By default, Microsoft Teams lets people from other organizations chat with your users. That’s handy when your accountant wants to message you. It’s also handy for an attacker, who can spin up a cheap Microsoft 365 account of their own, name it Help Desk, and message anyone they want. Teams shows a small External label, but in the middle of an inbox meltdown, nobody’s reading labels.

Step 3: The screen share

The fake tech asks the person to open Quick Assist (a remote support tool that’s built into Windows) or install something like AnyDesk. Once they have control of the screen, they install their own tools, poke around the network, and set up for something bigger. Ransomware crews have been running this exact playbook since at least 2024, and it keeps working.

Why Small Offices Fall for It

Plenty of small businesses use an outside IT company. That means most staff have never met their IT person and have no idea how support normally reaches out. So when someone calling themselves IT shows up in Teams during an obvious emergency, it makes total sense to say yes.

The attacker isn’t exploiting a software bug. They’re exploiting the fact that your team doesn’t know what normal looks like.

What This Means for YOU

A remote session on an employee’s computer is the attacker sitting in that employee’s chair. Whatever that person can open, the attacker can open. Email, shared drives, the accounting software, the browser with saved logins. It takes minutes, not hours.

How to Shut This Down

1. Tell your team exactly who IT is

Write it down. Who your IT support is, what their name looks like in Teams or email, and how they’ll contact you. Then add the important part: real IT support will never cold-message you from an outside account and ask for a screen share. If anyone gets one of these, they hang up and call your known IT contact on a number they already have.

2. Teach people to look for External

Show your team what the External tag looks like on a Teams chat. Anyone claiming to be internal IT while showing up as External is lying. That one check catches this scam almost every time.

3. Lock down Teams external access

This is the big one, and it takes about ten minutes. In the Teams admin center, find the external access settings. Instead of allowing every outside organization, switch it to allow only the specific domains you actually work with, like your accountant, your attorney, and your main vendors. While you’re in there, turn off chats with unmanaged personal Teams accounts unless you have a real reason to keep them.

Microsoft has added some warnings for suspicious outside messages, which helps. I wouldn’t count on it as your only defense.

4. Remove Quick Assist if you don’t use it

If your IT provider uses a different remote support tool, there’s no reason to leave Quick Assist sitting on every machine. On Windows 11 it can be uninstalled or blocked. Ask your IT person before ripping it out, just to make sure it’s not what they use.

5. Treat an inbox flood as a warning sign

This is the part most people miss. The spam flood is the setup. Tell your team: if your inbox suddenly explodes with junk, report it to your real IT, and expect a fake helper to reach out next. Once people know the pattern, the second step stops working.

The Takeaway

This scam works because it shows up right when people are confused and want help. You can’t stop someone from signing your email up for a thousand newsletters. You can make sure your team knows that the helpful stranger who appears afterward is the real problem.

Lock down Teams this week, then spend five minutes at your next staff meeting walking through this pattern. It’s one of the cheapest fixes you’ll make all year.

Want your team trained to spot this kind of thing before it happens? See what we offer at yourtech.solutions.