contact@trustinfinitech.com (573) 234-6540

“Hi, This Is IT”: Why Your Help Desk Became the Front Door

Home/News/“Hi, This Is IT”: Why Your Help Desk Became the Front Door

November 9, 2026  ·  Austin Hindery  ·  Latest News Managed Services Security Newsletter

A sleek headset lifted from its cradle on a dark reflective desk, glowing warm amber in a cool blue office at dusk, representing a single call that can open access to an organization.

Picture an employee whose inbox suddenly fills with newsletter sign-ups. Minutes later, a Microsoft Teams message arrives from “IT Support” offering to clean up the mess. After a short call and a few clicks, the “technician” has remote control of the laptop.

That scenario is drawn from documented attacks. On October 26, 2026, Arctic Wolf reported more than 400 incidents in which attackers used Teams external chat to pose as IT support, with malicious code sometimes running in under 15 minutes after the employee engaged, according to Infosecurity Magazine. In the same month, ASOS and Dexcom both disclosed incidents tied to impersonation or phone-based social engineering.

Many organizations treated multifactor authentication (MFA) as the finish line for account security. These attacks go around it by persuading a person to open the door, and the help desk, or someone pretending to be the help desk, is now where that persuasion happens.

Key takeaways

  • Attackers increasingly impersonate IT staff to employees, or impersonate employees to IT, to get access that passwords and MFA alone do not protect.
  • By default, Microsoft Teams lets people from any external organization find and chat with your employees. Most small and midsize organizations do not need that.
  • The most effective fixes are a written verification rule for every reset and every remote session, backed by a handful of specific settings.

What happened in October

Three disclosures from the past month show the pattern from different angles.

  • Fake help desk chats in Teams. Arctic Wolf documented more than 400 incidents of Teams external chat abuse. In 30 to 40 percent of cases, attackers used free onmicrosoft.com tenants with IT-sounding names, and some display names included “(Internal)” to look like coworkers. The fake technician often moved the target to a voice call and had them install remote access software, most commonly Quick Assist. Some intrusions led to data theft and ransomware, Help Net Security reported. No Teams vulnerability was involved.
  • ASOS. On October 8, the retailer said “an unauthorised party gained access to an ASOS employee account by impersonating a trusted contact” to obtain login credentials, which were then used to reach information on third-party platforms. ASOS said customer names and contact details were involved and that payment card information and account passwords were not accessed, according to BleepingComputer.
  • Dexcom. In an October 10 statement, the medical device maker said “targeted vishing events” (voice phishing) led to unauthorized access to “limited information from certain internal documents.” The company said there was no impact on its products or operations.

None of this is a new invention. Microsoft described the same inbox-flooding and Quick Assist approach in May 2024, and a joint FBI and CISA advisory from November 2023 described attackers persuading help desk staff to reset passwords and MFA tokens. What has changed is volume and speed.

Two ways through the same door

These attacks run in two directions, and each needs its own control.

Attacker poses as IT to an employee. This is the Teams pattern. It works because employees often do not know how their IT team normally contacts them. In a 50-person office with an outsourced provider, a message from an unfamiliar name claiming to be “support” may not seem unusual at all.

Attacker poses as an employee to IT. This is the reset pattern. A caller claims to have a new phone or a locked account and asks for a password reset or a new MFA enrollment. If the help desk verifies identity with details that can be found on LinkedIn or in a data breach, a convincing caller can walk away with a working account.

Why it matters

The following is InfiniTech’s analysis.

MFA protects the login. It does not protect the process that issues, resets, or bypasses that login. A help desk that can re-enroll MFA on a single phone call has made MFA only as strong as its verification questions.

These attacks also use legitimate tools through legitimate channels. Teams chat, phone calls, and Quick Assist are all things employees are told to trust, so traditional filters that look for malicious links or attachments have little to catch. Arctic Wolf observed attackers deliberately avoiding links in Teams and downloading files during the remote session instead.

The help desk’s job is to be helpful, quickly. That is exactly the instinct attackers exploit. For smaller organizations where IT is one or two people, or a provider the staff rarely talk to, the pressure to “just fix it” is even stronger.

What to do next

This week

  1. Publish one sentence about how IT contacts people. For example: “IT will never message you first from an outside organization or ask you to install remote access software unless you opened a ticket.” Put it in onboarding and repeat it in your next all-staff message.
  2. Tighten Teams external access. Microsoft’s Teams admin documentation confirms that all external domains are allowed by default. Switch to “Allow only specific external domains” and list your partners, turn off chat with unmanaged Teams accounts if you do not need it, and confirm trial-only tenants are blocked. Expect a few partner requests afterward, and keep a simple way to add them.
  3. Restrict remote access tools. Remove or disable Quick Assist where it is not used, as Microsoft recommends, and allowlist the one remote support tool your IT team uses. Any other remote tool appearing on a workstation should trigger a question.

This quarter

  1. Write a reset verification rule. No password or MFA reset based on information a stranger could look up. Workable options include calling back the number on file in your HR system, confirming with the employee’s manager, or a live video check with ID for MFA re-enrollment. Require a second approver for executive, finance, and administrator accounts.
  2. Move high-risk accounts to phishing-resistant MFA. The FBI and CISA advisory recommends FIDO/WebAuthn or PKI-based MFA. Start with administrators, finance staff, and executives.
  3. Watch for the sequence. Alert on a sudden inbox flood, a new external Teams chat, a new MFA method registration, or a remote tool launching shortly after any of them.
  4. Ask your IT provider four questions. How do you verify a caller before a reset? Can a reset ever happen on a single call? Who is alerted when a new MFA method is registered after hours? How would you know if Quick Assist ran on one of our machines?

Where InfiniTech fits

The InfiniCare Advanced Security Bundle addresses several of these steps. It includes Managed Detection and Response (MDR), with 24/7 monitoring, investigation, and response across endpoints, servers, Microsoft 365, and firewalls; Microsoft 365 hardening; and cybersecurity awareness training with simulated phishing tests. If you would like a second set of eyes on your Teams and reset settings, our team can walk through them with you.

The bottom line

The October disclosures point to one conclusion: access is only as strong as the conversation that can grant it. Give your employees one clear rule for recognizing IT, give your help desk one clear rule for recognizing employees, and treat every reset and remote session as an identity decision.

Sources

← Back to News