# Attackers use Teams support impersonation to gain remote access and deploy ransomware

_Published Monday, October 26, 2026 at 10:18 PM EDT · Security · Latest · Tier 2 — Notable_

![Attackers use Teams support impersonation to gain remote access and deploy ransomware — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGj3R5UeJnb_pAG2XH5cEGUzKbzeRHLNAES48EgHC8ssOnuDbDOqJA9ydPHJqmxYONu2lCeu42YOv_e_XA2RtX5jVGsMkQY0QAGrzoqmY4qU6NnWrPTfX0V-U68B9Z80KHLJvZDtUeSm4dvkp06oJ9JmgJvr7CDYZ-48fwAOENt31Lrcpr4M6O_4x6ovLZ/s1700-nu-rw-lo-l85-e365/support.jpg)

Attackers have used Microsoft Teams external chats to impersonate IT support across hundreds of cases, Arctic Wolf Labs reported. Victims often receive hundreds of subscription emails before a supposed support worker contacts them and persuades them to grant access through legitimate remote-access software.

Arctic Wolf observed attackers increasingly adding the target company's name to display names. During remote sessions, attackers often navigate to malicious downloads themselves rather than paste links into Teams, avoiding message-based link scanning. Intrusions have included reconnaissance, data theft and ransomware deployment. The attacks target organizations with external access enabled and exploit trust rather than a software vulnerability.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/attackers-use-microsoft-teams-it.html)

---
Canonical: https://techandbusiness.org/newswire/RLYOWlPb-e6DpdgrSkyLdz
Published: 2026-10-27T02:18:35.202Z
Story chronology: 2026-10-26T15:52:00.000Z
Retrieved: 2026-10-27T04:26:36.803Z
Publisher: Tech & Business (techandbusiness.org)