First, your inbox fills with hundreds of newsletter and subscription confirmations in a few minutes. Then a Teams message arrives from "IT Support (Internal)" offering to fix it. Arctic Wolf says it has seen this pattern in more than 400 incidents. Attackers set up their own Microsoft 365 accounts with help desk-style names and use Teams’ outside chat feature to message employees, per The Hacker News. Recently they’ve started putting the target company’s name in their display name. Teams still labels them "External," and that label is the tell.

What happens next. The fake help desk often calls the victim inside Teams and talks them into installing or opening a remote-access tool. Quick Assist, which is built into Windows and only needs the user to read back a six-digit code, was the most common, and attackers also used tools like AnyDesk, ScreenConnect and TeamViewer. Once a victim engages, Arctic Wolf says attackers can be running their own software in under 15 minutes. From there they steal data and, in some cases, deploy ransomware. Sophos has tied related attacks to Chaos ransomware.

Why small offices are exposed. Teams ships with outside chat (Microsoft calls it external access) turned on by default, and this attack doesn’t use any software bug. "It exploits trust rather than a software vulnerability," Arctic Wolf said. Offices without a formal help desk are the easiest place for a fake one to step in.

Action item: Close the door and set one rule.
1. Limit outside chat. In the Teams admin center, under Users > External access, switch to "Allow only specific external domains" and add only the partners you actually work with. Arctic Wolf also recommends blocking chat with unmanaged Teams accounts and with trial-only Microsoft 365 tenants.
2. Restrict remote-access tools. Limit Quick Assist to the people who do IT, or remove it where it isn’t used, and block remote-access tools your IT provider didn’t install.
3. Tell staff the one rule: real IT will never cold-message you on Teams. Write down exactly how your IT person or provider will contact people, and require a callback to a known number before anyone grants remote access.
4. Watch for the flood. If someone’s inbox suddenly fills with sign-up emails, treat any "help" that shows up next as part of the attack.

Second item: Update Microsoft Authenticator on Android. Microsoft fixed a flaw, CVE-2026-80097, that let a malicious app on an Android phone pose as Teams and get the sign-in tokens Authenticator hands to Microsoft apps, per Help Net Security. In researchers’ tests at Enclave, those tokens could read and send email, change files and calendars, and even change the account’s sign-in methods, including passkeys. Someone would first have to install a malicious app. Enclave says no further taps were needed after that, while Microsoft says the user would also have to complete a sign-in step. Microsoft says the flaw has not been used in attacks, per The Hacker News. It’s fixed in version 6.2606.4246, part of September’s updates.

Everyone on Android: open Authenticator in the Google Play Store and confirm you’re on 6.2606.4246 or later.

If you manage company phones: require that minimum version in your device management, and only allow apps from trusted stores.

Also today

Yesterday’s check still applies. If you think someone’s Microsoft 365 sign-in was stolen, by a fake help desk or a rogue app, the device, sign-in method and inbox-rule checks are in yesterday’s briefing.