{
  "id": 5372776,
  "title": "IT helpdesk impersonation hits Microsoft Teams once again, with the hackers hiding their activity within legitimate tools",
  "url": "https://urgent.news/2026/09/03/it-helpdesk-impersonation-hits-microsoft-teams-once-again-with-the",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-03T16:55:00.000Z",
  "source": {
    "name": "TechRadar",
    "slug": "techradar",
    "url": "https://www.techradar.com/pro/security/it-helpdesk-impersonation-hits-microsoft-teams-once-again-with-the-hackers-hiding-their-activity-within-legitimate-tools"
  },
  "original_language": "en",
  "account": "Microsoft warns of a hacking campaign targeting Microsoft Teams, where attackers impersonate IT support staff. Victims receive a Teams message, leading them to grant remote access, which enables the hackers to install malware and gain access to sensitive data. The attackers map out the victim's network, enumerate domain accounts, servers, and users, and move laterally within the system. The final stage involves identifying and extracting valuable data, followed by a ransomware infection. The attackers have been linked to various groups, including Russia's Cozy Bear, FIN7, Storm-1811, and ShinyHunters. Microsoft advises enterprises to reinforce user education, verify unsolicited support contact, and harden Microsoft Teams and email against social engineering. They recommend using Microsoft Defender for Office 365 with Safe Links and Zero-hour auto purge (ZAP) to neutralize malicious messages and URLs at the time of delivery.",
  "summary": "Microsoft is warning about an ongoing scam campaign starting in Teams.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "TechRadar",
        "title": "Clicking 'Allow' on a Google and Microsoft permission screens could give hackers access to your entire account, FBI warns",
        "url": "https://urgent.news/2026/09/03/clicking-allow-on-a-google-and-microsoft-permission-screens-could",
        "published": "2026-09-03T14:45:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}