Email Bombing and Help Desk Impersonation over Teams Guide: Detect and Block the Fake IT Support Playbook

Ransomware crews have found that the fastest way past email security is to bury a user in thousands of junk emails and then call them on Microsoft Teams, posing as the help desk offering to fix it. The pattern, first documented in spring 2024 against organisations later hit by Black Basta, has a simple shape: a flood of subscription emails, a message or call from an external Teams tenant named "Help Desk", and a remote support session that hands the attacker the keyboard. It works because Teams allows chats from any external organisation by default and because built-in tools such as Quick Assist look legitimate. This guide explains how the attack runs, who uses it, what to detect, and the Teams, endpoint and help desk changes that shut it down. It is for Microsoft 365 administrators, SOC analysts and service desk leads. The broader family of call-based lures is covered in the Callback Phishing (TOAD) Guide.

Key takeaways

• The spam is the pretext, not the payload. Email bombing (ATT&CK T1667) creates a real problem so that a fake help desk offer feels timely and welcome.
• Default Teams external access is the delivery channel. "Allow all external domains" is the default, so any attacker-created tenant can message or call your users unless you restrict it.
• Remote support tools do the initial access. Quick Assist, AnyDesk or Teams screen sharing give hands-on control within minutes, with no exploit needed.
• Credentials follow the session. Fake "spam filter update" prompts and adversary-in-the-middle pages capture passwords and session tokens while the attacker sets up persistence.
• A help desk verification rule is the cheapest control. If users know that internal IT never cold-calls through external Teams accounts, and how to check, most attempts fail at the first message.

How the attack works

Microsoft, Rapid7 and Sophos describe near-identical sequences. The steps below combine their reporting; individual intrusions skip or reorder some of them.

1. Email bombing: the attacker signs the target up to large numbers of newsletters and services (Microsoft calls this link listing). Sophos saw up to 3,000 emails in under an hour aimed at a few individuals. Because the messages are genuine subscription confirmations, spam filters let many through.
2. The offer of help: the attacker phones the target, or from late May 2024 sends a Teams chat or call from an attacker-controlled Microsoft 365 tenant with a display name such as "Help Desk" or "IT Support", offering to stop the spam.
3. Remote control: the user is talked into opening Quick Assist (Ctrl+Windows+Q) and entering a code, installing AnyDesk, or granting control in a Teams screen share. Sophos observed one cluster guiding victims to download Quick Assist from Microsoft's own site.
4. Tool staging: the attacker runs cURL or BITSAdmin to pull batch scripts and archives presented as spam filter updates. Rapid7 saw a renamed OpenSSH binary (RuntimeBroker.exe) for a reverse shell; Sophos saw a signed OneDriveStandaloneUpdater.exe sideloading a malicious winhttp.dll, and a Java archive running a Python-based backdoor.
5. Credential capture: a script prompts the user to "sign in" to finish the update and sends the password to the attacker; Microsoft also saw links to an EvilProxy adversary-in-the-middle page that captures passwords and session tokens.
6. Persistence and expansion: Qakbot, ScreenConnect, NetSupport Manager, Cobalt Strike, SystemBC and SSH tunnels give durable access; discovery, SMB and RDP movement follow.
7. Impact: Microsoft observed Storm-1811 deploying Black Basta with PsExec. Sophos saw an attempted Black Basta deployment blocked by endpoint protection.

ATT&CK mapping

Where it shows up

Sophos counted more than 15 incidents in three months, about half in the final two weeks, which shows how quickly the method spread once it worked. Any organisation on Microsoft 365 with default external access is exposed; the same idea works with other collaboration platforms and plain phone calls.

Impact

• Hands-on access to a workstation: the attacker gets interactive control under the user's identity, inside the network and past perimeter controls.
• Credential and session theft: passwords typed into fake prompts and session tokens captured by proxy pages allow sign-in to Microsoft 365 and other SSO apps.
• Ransomware and extortion: the documented end state is Black Basta deployment across the domain, with data theft before encryption.
• Productivity loss: the email flood alone can make a mailbox unusable for a day and swamp the real service desk with tickets.

Detection

• Mail volume anomaly: alert on a per-recipient spike in inbound mail. Microsoft publishes a time-series hunting query for this, and since June 2025 Defender for Office 365 classifies mail bombing as a Detection technology value in Threat Explorer and a DetectionMethods value in Advanced Hunting.
• External help desk personas: alert on one-to-one Teams chats or calls from external tenants whose display name contains help, support, IT, admin or service desk, as in Microsoft's hunting query.
• Bomb then contact: correlate a mail bombing detection with an external Teams contact or a phone call to the same user within a few hours; this pair is rare in normal business.
• Remote tool start after external contact: quickassist.exe, AnyDesk, ScreenConnect or NetSupport starting on a device within an hour of external Teams activity for that user. Defender for Endpoint raises "Suspicious activity using Quick Assist".
• Staging commands: curl.exe or bitsadmin.exe downloading archives, new Run keys, ssh.exe or renamed OpenSSH making outbound connections from workstations.
• Identity signals: a new sign-in for the user from an unfamiliar IP or ASN, MFA method changes, or token replay alerts during or after the session.

Metrics

• Percentage of users who can receive chats from any external tenant (target: only those with a business need).
• Number of endpoints where Quick Assist and unapproved RMM tools can run.
• Median time from mail bombing detection to proactive contact by the real service desk.
• Teams and phone impersonation reports per month, and the share reported before any session was granted.
• Results of simulated fake help desk calls: percentage of staff who verify through the official channel.

Prevention and hardening

Teams external access settings

Organisation settings and user policies both have to allow a feature, so you can keep federation for a partner-facing group while closing it for everyone else. Note that blocking a domain does not block its subdomains unless -BlockAllSubdomains is set. See the Microsoft Teams Security Guide for the wider Teams baseline.

Endpoint and identity controls

• Remove or block Quick Assist where it is not used: uninstall it or block it with AppLocker or Application Control for Business, and block unapproved RMM tools. Microsoft suggests Remote Help in the Intune Suite where a supported tool is needed. See the RMM Tool Security Guide.
• Attack surface reduction: enable rules that block process creation from PsExec and WMI commands and block potentially obfuscated scripts, plus tamper protection, as Microsoft recommends.
• Phishing-resistant authentication: use Conditional Access authentication strength for critical apps so a captured password or proxied sign-in is not enough.
• User reporting: turn on Teams message and call reporting in Defender for Office 365 so users can report a fake help desk contact in one click.

Help desk and user process

• Publish one rule: internal IT will never contact you from an external Teams account or ask you to start Quick Assist unless you raised a ticket; check the "External" marker and the profile card.
• Proactive contact: when mail bombing is detected, the real service desk contacts the user through a known channel first, which removes the attacker's opening.
• Callback verification: users who receive a call hang up and call the published service desk number. See the Vishing and Help Desk Social Engineering Awareness Guide.

Phased rollout

1. Week 1: export current external access settings and Teams external chat logs; identify which users actually chat with which external domains.
2. Week 2: turn off inbound contact from unmanaged accounts, deploy the mail bombing and external help desk persona detections, and brief the service desk.
3. Weeks 3 to 4: pilot an allow list of partner domains with one department; collect breakage reports.
4. Weeks 5 to 8: roll the allow list policy out by ring, and block Quick Assist and unapproved RMM through application control in audit mode first, then enforce.
5. Rollback: reassign the previous external access policy to an affected group, or add a domain to the allow list; application control rules can return to audit mode while exceptions are approved.

Framework mapping

Lessons from incidents

The Storm-2949 Azure attack shows the identity end of the same idea: an attacker posing as internal IT pressured users into approving MFA prompts, then reset passwords, removed their authentication methods and enrolled its own authenticator, reaching Azure and Microsoft 365 data. Whether the lure arrives through a flood of email and a Teams call or through a reset request, the control that breaks it is the same: users and service desk staff verifying identity through a channel the attacker does not control. The MGM Resorts breach is the mirror image, where the attacker called the help desk instead of the user.

Practitioner checklist

• Move Teams external access from "Allow all external domains" to an allow list or a restricted per-user policy.
• Turn off inbound contact from unmanaged Teams accounts and keep trial tenants blocked.
• Deploy detections for mail bombing, external help desk display names and remote tool launches after external contact.
• Uninstall or block Quick Assist and unapproved RMM tools; use one approved, authenticated support tool.
• Have the real service desk contact users proactively when mail bombing is detected.
• Enable Teams message and call reporting and give the SOC rights to block attacker tenants.
• Require phishing-resistant authentication for critical apps through Conditional Access.
• Run a fake help desk simulation and measure how many staff verify before granting access.

Standards and references

• Microsoft Threat Intelligence: Threat actors misusing Quick Assist in social engineering attacks leading to ransomware
• Microsoft Learn: Manage external meetings and chat with people and organisations using Microsoft identities
• Microsoft Learn: What's new in Microsoft Defender for Office 365
• MITRE ATT&CK: Email Bombing
• MITRE ATT&CK: Storm-1811
• Rapid7: Ongoing Social Engineering Campaign Linked to Black Basta Ransomware Operators
• Sophos X-Ops: Sophos MDR tracks two ransomware campaigns using email bombing and Microsoft Teams vishing
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Callback Phishing (TOAD) Guide · Microsoft Teams Security Guide · Storm-1811 Threat Actor Profile Guide · RMM Tool Security Guide · Account Recovery and Help Desk Security Guide