Fake IT support on Teams

Your inbox suddenly fills with hundreds of emails. Minutes later, “IT support” messages you on Teams offering to fix it — if you share your screen.

What it looks like

Teams chat · IT Help Desk (external)

Hi, we see your inbox is being flooded with spam. I can fix it right now — please open Quick Assist and send me the code.

How it usually ends

The spam flood was the setup. 'IT' was the attacker, and the Quick Assist code handed over your screen. Ransomware followed two days later.

Red flags

External Teams account posing as internal IT
Request to launch a remote-access tool
Arrives right after an email flood

A real case

Microsoft saw Storm-1811 bomb inboxes with sign-up emails, then pose as IT on Teams and ask for Quick Assist — a route to Black Basta ransomware (2024).

What to do

Contact IT yourself through the channel you already know.
Never open Quick Assist, AnyDesk or similar for someone who contacted you.
Report sudden email floods: they are often the first step.

Could you spot it in the moment?

In Painted Sky you’re born at random somewhere on Earth and live a whole life — and this scam is one of the fakes that can find you. Make the call yourself, then replay the same life with a lens that shows what was fake.

Play Painted Sky — free →