Topic starter
25/06/2026 3:10 pm
TL;DR: Threat actors are increasingly using Microsoft Teams direct messages and calls to impersonate IT support, push remote access tools, and deliver PowerShell payloads, according to Permiso Security. The pattern shows that collaboration platforms now create identity trust paths that security teams must govern alongside email and endpoint controls.
Editorial analysis by NHI Mgmt Group, based on content published by Permiso Security: “Sliding into your DMs: Abusing Microsoft Teams for Malware Delivery”.
Key questions
Q: What breaks when attackers can start a support conversation inside Microsoft Teams?
A: When an attacker can open a support-looking conversation inside a collaboration platform, users often treat the channel as proof of legitimacy.
Q: Why do collaboration-platform impersonation campaigns create so much risk?
A: They work because the attacker borrows an environment users already trust for daily operations.
A: Common warning signs include unusual login behaviour, out-of-hours data movement, abnormal LDAP query volumes, new privileged accounts, suspicious internal traffic, and employees receiving urgent requests that bypass normal process.
Practitioner guidance
- Tighten external Teams communication rules Restrict who can message or call users from outside the tenant, and review exceptions for support, contractors, and federated collaboration flows.
- Harden remote support handoffs Separate help desk identity verification from the act of granting QuickAssist, AnyDesk, or similar access.
- Monitor PowerShell and persistence markers Alert on hidden PowerShell execution, scheduled task creation, registry autoruns, and unusual credential prompts that follow a collaboration-platform contact.
Bottom line: Microsoft Teams abuse turns social engineering into an identity problem because users often trust the channel before they verify the sender.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:32 pm
Microsoft Teams trust is now part of the identity perimeter: When collaboration platforms sit inside daily operational workflows, users treat them as an implicit trust signal. That assumption is exactly what attackers exploit when they impersonate support or internal contacts. The governance problem is no longer just whether a message is malicious, but whether the platform allows trust to be granted before identity has been verified. Practitioners should treat collaboration trust as a governed identity control, not a user behaviour issue.
A few things that frame the scale:
- Voice phishing was the most common initial infection vector in cloud intrusions in 2025 (23%) and the second most common across all intrusions (11%), according to Mandiant's M-Trends 2026.
A question worth separating out:
Q: How should teams respond when chat-based support turns into remote access?
A: Treat the remote-access handoff as a security event, not a service interaction. Verify the support relationship through an out-of-band process, terminate any unapproved remote session, isolate the endpoint if scripts have run, and review adjacent accounts and devices for persistence or credential exposure.
👉 Read our full editorial: Microsoft Teams abuse shows how trust becomes an attack path