Hackers used Microsoft Teams to talk their way into corporate networks, posing as IT or help desk staff and persuading employees to hand over remote access, according to a Microsoft report. The incidents described in the report began with Teams phishing messages and calls impersonating support personnel. The socially engineered workers were led to open Quick Assist and provide a connection code, giving the attackers hands-on-keyboard control of their workstations. Microsoft did not identify the targeted companies.
Once inside, the intruders set up software using Python, Bun or Java runtimes, opened up networks and granted themselves authentication, which gave them free rein over corporate systems. But the entry point in each case was a person who granted access to the intruder. The report indicates that a human had to be convinced before any of the follow-on activity could take place, making the employees the decisive link in the chain.
News of the Teams incidents arrives as much of the public discussion around cybersecurity has focused on AI-driven threats. Over the past year, frontier AI models have been described as accelerating the pace of cyberattacks, and in the case of Anthropic's Mythos, the models had to be paused. The Microsoft report, by contrast, shows human hackers still relying on social engineering scams to fool other humans into doing their dirty work.
Microsoft told CNET it is introducing AI-powered phishing detection that it says uses conversation context to identify phishing and social engineering in higher-risk messaging scenarios, particularly first-contact chats with external users. The feature was listed on Microsoft's roadmap for the software, which was revealed last month. That roadmap also includes ways to report suspicious guest invitations and to blur QR codes sent by external senders.
Much of the burden of stopping such intrusions still falls to companies and their employees. A Microsoft spokesperson said users should exercise caution with external connection requests and messages, including verifying a sender's identity and requests before acting on them. Administrators can also block external Teams users and specify which users in their organization are permitted to chat or meet with people outside the enterprise.
Yu Cai, associate director of the Institute of Computing and Cybersystems at Michigan Tech, said social engineering attacks remain widespread, adding that human-led social engineering is still a major cybersecurity threat even as AI cyberattacks draw most of today's headlines. Cai noted that AI can make such hacks more convincing through tools like voice cloning or deepfake videos. He said what was most surprising about the Microsoft Teams incidents was how simple the approach was, and that sophisticated attacks do not necessarily have to begin as sophisticated hacks. The incident was not caused by vulnerabilities in the Teams software, he said, but by employees placing trust in communications that come through the tools they use every day.
More cybersecurity news from TechManNews.
