In short: Microsoft Teams phishing uses chats, calls, meeting invites and shared files in Teams and similar collaboration apps to trick people. A common pattern is a fake IT support contact from an external account asking the user to start a remote support session. Staff should check for the External label, verify through known channels and report suspicious messages.
Why attackers use Teams
Collaboration apps feel internal and informal. Many people have been taught to be wary of email but answer a Teams chat without a second thought. Attackers take advantage of this in several ways:
- External access: by default, many Teams tenants can chat with users in other organisations, so a criminal can create their own Microsoft 365 tenant with a name such as "Help Desk" and message your staff
- Compromised partner accounts: a genuine supplier's account, once hijacked, can message you from a trusted name
- Guest accounts and shared channels that have outlived the project they were created for
- File shares that look like ordinary OneDrive or SharePoint links but lead to fake sign-in pages
- Calls: voice calls inside Teams feel more trustworthy than a call from an unknown number
The same tactics apply to Slack, Zoom, Google Chat and other collaboration tools.
The fake IT support attack
One pattern seen widely in security research is a two-step approach. First, the user's inbox is flooded with spam or sign-up emails. Then, a Teams chat or call arrives from an account named something like "IT Support" or "Help Desk", offering to fix the problem. The caller asks the user to open a remote assistance tool such as Quick Assist, or to install remote support software, and then takes control of the device.
Staff should know three facts that break this attack:
- Your IT team will not normally contact you unexpectedly from an external account
- You should never start a remote support session that you did not request through your normal service desk route
- If something feels wrong, end the chat or call and contact IT through the service desk portal or directory number you already know
This overlaps with help desk social engineering, where the attacker plays the employee instead of IT.
What staff should check
Before acting on any Teams message, call or file share:
- Look for the External label and the organisation name next to the sender. Teams flags people from outside your organisation, and new external chats arrive as a request you can accept or block.
- Do not trust the display name alone. Anyone can name their account "IT Support" or use a colleague's name.
- Treat unexpected files and links with the same caution as email, especially if they lead to a sign-in page.
- Never share passwords or MFA codes in a chat, and never approve an MFA prompt you did not start.
- Verify through a separate channel before doing anything you are asked: a known number, the service desk portal or a colleague in person.
- Report it, then block the sender if Teams offers the option.
How to report suspicious Teams messages
In organisations with Microsoft Defender for Office 365 Plan 1 or Plan 2, or Microsoft Defender XDR, users can report Teams items directly to their security team and to Microsoft:
- Messages: hover over the message, select More options, then Report this message, and choose the security risk option
- Calls: from the call history, select More options, then Report call
- Meetings and participants: during or after a meeting, use Report a concern, and optionally pick the participants involved
Admins need to turn on the Report a security concern setting in the Teams admin center, and check the Teams user reported settings in the Microsoft Defender portal, which existing tenants may need to enable. Reports then appear alongside reported emails for triage. Our how to report phishing page covers email reporting and the UK national routes.
Controls that back up training
Training is much more effective when the obvious routes are closed:
- Restrict Teams external access to the domains you work with, rather than leaving it open to every organisation
- Review guest accounts and shared channels regularly, and remove those no longer needed
- Limit which remote assistance tools can run on company devices, and who can use them
- Use email and collaboration security that scans Teams messages and files. Check Point Harmony Email and Collaboration (also available as Avanan) protects Teams as well as email, and Microsoft Defender for Office 365 can check links and files in Teams
- Phishing-resistant MFA, so stolen credentials are less useful; see password and MFA training
See Microsoft 365 security for a wider review of your tenant settings.
Training for collaboration-app phishing
Most simulation platforms concentrate on email. Microsoft's current documentation for Attack Simulation Training describes email-delivered simulations and does not list Teams as a simulation channel, so ask us for the current position on any platform before planning Teams-based tests. Instead, we cover Teams phishing in short modules and team briefings, include a fake IT support scenario in tabletop exercises, and make sure every user knows how to report a suspicious chat.
Contact us to add Teams and collaboration-app phishing to your programme.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Can you get phished on Microsoft Teams?
Yes. Attackers send Teams chats, calls, meeting invites and file links, often from external accounts with names such as "IT Support". The aim is usually to steal a password or persuade the user to start a remote support session.
How do I know if a Teams message is from outside my organisation?
Teams shows an External label and the sender's organisation for people outside your tenant, and new chats from external people arrive as a request you can accept or block. Treat any unexpected external contact claiming to be internal IT as suspicious.
How do I report a phishing message in Teams?
Hover over the message, select More options, then Report this message and choose the security risk option. Your organisation needs Teams reporting switched on, which requires Microsoft Defender for Office 365 Plan 1 or Plan 2.
Should we block external access in Teams?
Many organisations restrict external access to an allow-list of partner domains rather than blocking it completely. That keeps collaboration working while removing the easiest route for fake IT support approaches.
Does Attack Simulation Training include Teams phishing simulations?
Microsoft's current Attack Simulation Training documentation describes email simulations and does not list Microsoft Teams as a simulation channel. You can still train for Teams phishing with modules, briefings and tabletop exercises. Ask us for the current position before planning Teams-based simulations.