The Fake IT Guy Is No Longer Hiding in an Email—He Is Calling You on Teams

Most people know what a suspicious email looks like.

The spelling is terrible. The company logo appears to have been copied from a fax. A prince needs money. SARS apparently wants payment in Bitcoin.

We have spent years teaching employees not to click strange links or open unexpected attachments.

The problem is that the fake IT guy is no longer only hiding in your inbox.

He can now call you directly on Microsoft Teams, use an ordinary person’s name, speak confidently and guide you through the attack while you are sitting at your computer.

That live interaction changes everything.

An email gives you time to become suspicious. A person on a call creates pressure, urgency and a strange sense of obligation to cooperate.

Microsoft observed 141,000 malicious Teams call attempts

Microsoft Threat Intelligence says it observed approximately 141,000 malicious Microsoft Teams call attempts during the third quarter of 2026.

That number includes unanswered, rejected and short-lived calls, so it does not mean 141,000 businesses were successfully compromised.

It does show that criminals are actively using Teams calls, chats, screen sharing and remote-support tools as part of social-engineering attacks.

Microsoft also noticed an interesting change in how these callers present themselves.

Attackers are moving away from obvious names such as “IT Helpdesk” or “Microsoft Support”. In Microsoft’s sample, ordinary personal names represented 46% of malicious Teams caller identities in July and 88% by September.

That makes sense.

You may immediately distrust an unexpected call from “URGENT MICROSOFT TECHNICAL SUPPORT”. A call from “Daniel Jacobs” or “Sarah Williams” feels far more like an ordinary consultant, supplier or colleague.

What does the fake IT-support call look like?

The attacker may begin with a believable story:

• “We detected a problem with your Microsoft 365 account.”
• “Your computer is sending unusual traffic.”
• “There is an urgent security update we need to install.”
• “Your mailbox is almost full.”
• “We are migrating your company to a new Teams environment.”
• “Your IT provider asked us to assist you.”
• “We need to reconnect your OneDrive.”

Some of those are real problems businesses deal with every day, which is exactly why the story works.

The caller may know your name, company, email address, job title or IT provider. That information can come from LinkedIn, your company website, a previous data breach or an earlier phishing email.

Knowing personal information does not prove that the caller is legitimate.

Once the conversation starts, the attacker may ask you to:

• Share your screen
• Install remote-support software
• Visit a website
• Enter a code into a genuine Microsoft page
• Approve a Microsoft Authenticator notification
• Disable a security feature temporarily
• Open PowerShell or Command Prompt
• Give them control of the computer

The caller will normally explain why every step is necessary.

That is the danger. You are not simply clicking a random link anymore. You are being coached by a person who can answer your questions and adjust the story whenever you become uncertain.

A genuine Microsoft website does not make the request safe

One particularly nasty technique uses Microsoft’s legitimate device sign-in page.

The attacker generates a device code and asks the user to enter it at a real Microsoft address. The website is genuine. The Microsoft logo is genuine. The connection is secure.

But the code belongs to a sign-in request started by the attacker.

If the user enters the code and completes authentication, they may hand the attacker access to the Microsoft 365 account without ever revealing the password.

This is why “the website looked real” is no longer enough.

The website may be completely real while the request itself is fraudulent.

The one rule every business should implement

South African SMEs do not all have a full-time cybersecurity team watching every Teams call.

They do not need one complicated rule for email, another for Teams and seventeen pages of policy nobody will read.

Start with one simple rule:

Any unexpected request involving passwords, authentication codes, payments, remote access or security changes must be verified through a separate, known channel before anyone acts.

Not a number supplied by the caller.

Not a link they posted in the chat.

Not another person they conveniently invite into the same meeting.

End the call and contact your IT provider using the number already saved in your phone, listed in your support agreement or published on the provider’s official website.

If the request is genuine, your IT provider will understand why you checked.

If somebody becomes irritated because you want to verify an unexpected remote-access request, that is usually a very good reason to verify it.

What if you already gave the caller access?

Do not try to hide it because you feel embarrassed.

These attacks are designed to manipulate people, and the attacker may be extremely convincing.

Disconnect the computer from the network if the caller still has access, then contact your actual IT provider immediately from another device.

Tell them exactly what happened:

• Who contacted you
• Which account or name appeared
• What you installed
• Which websites you opened
• Whether you shared your screen
• Whether you entered any codes
• Whether you approved an authentication request
• How long the remote session lasted

Your IT provider may need to terminate active sessions, reset credentials, check authentication methods, review mailbox rules, inspect the computer and search for remote-access or persistence software.

Simply uninstalling the visible support application may not remove everything that happened during the session.

Teams is not suddenly unsafe

Microsoft Teams remains a legitimate business platform.

The problem is not that Teams calls are inherently dangerous. The problem is that people naturally trust communication arriving through a familiar work application.

Criminals know this.

They no longer need to create an obviously fake login page if they can persuade you to open the real page yourself. They do not need to break through the firewall if somebody inside the company voluntarily gives them remote control.

The next fake IT technician may not send a badly written email.

They may call during normal working hours, use a perfectly ordinary name and sound like they have helped your company many times before.

Slow the conversation down.

End the call.

Then phone the IT person you already know.