Attackers pose as helpdesk staff to obtain remote assistance

Microsoft reported on 18 April that attackers used cross-tenant Teams messages to impersonate IT or helpdesk staff and persuade people to grant remote assistance. The investigated chains then used signed applications, administrative protocols and commercial remote-management software to expand access and move information.

Quick Assist and similar tools are normal support software. In this campaign, the problem was who requested access and what happened after control was granted. Microsoft’s account highlights a chain that could reach higher-value systems through credentials and trusted administration paths. Verifying a support request through an established internal channel addresses an earlier point in that chain than judging the software by its signature alone.