Category hub: Social engineering and human risk

In one sentence: IT support impersonation is when a criminal pretends to be your help desk, by phone, email or Teams, to get a password, a code or control of your computer.

What it is

Staff trust the help desk, and attackers copy that trust. They contact an employee as IT support and say a problem needs fixing now.

There is a second version where the attacker calls your real help desk pretending to be a member of staff. The FBI and CISA describe Scattered Spider as a criminal group that targets large companies and their contracted IT help desks. Both versions end the same way: a reset, a code or remote access the attacker should not have.

How it works

1. Set-up. Some attackers flood the target’s inbox with harmless spam. Microsoft and MITRE both describe this as a way to create a reason for a “help desk” call.
2. Contact. The attacker calls, or messages on Teams. Microsoft saw attacker-created tenants with names such as “Help Desk”, “Help Desk IT” and “IT Support”.
3. Request. They ask the person to read out an MFA code, approve a prompt, share their screen or install a remote tool.
4. Control. With access they install more tools, collect passwords and move around the network.
5. Pay-off. Data theft, fraud or ransomware. Microsoft linked one such group, Storm-1811, to Black Basta ransomware.

Who it affects and how badly

• Sole trader to 10 staff. You may have no help desk, so any call from “IT” sounds plausible. Worst case: a stolen email account and a locked business.
• 10 to 250 staff. Offices that use an MSP expect support calls. Accountancy, legal and construction firms hold payments and client data.
• 250 plus and regulated firms. Big help desks face reset requests all day, so bad ones hide. Telecoms, retail and insurers appear in public advisories.
• MSPs. One impersonated client user can open a path to that client’s systems.

Real examples

• Storm-1811, 2024. Microsoft reported that from mid-April 2024 this group used voice phishing and Quick Assist to get remote access, then delivered tools including Qakbot and Cobalt Strike, and in several cases used PsExec to deploy Black Basta ransomware. From the end of May it also used Teams messages and calls. Microsoft suspended the identified accounts and tenants.
• Scattered Spider. The FBI, CISA and partners including the UK’s NCSC published and updated an advisory covering the group’s help desk social engineering, push bombing and SIM swap attacks.

How to detect it

• A burst of junk email or newsletter sign-ups to one person, followed by an offer of help.
• Teams messages from external accounts named like IT support. Review external access in the Teams admin centre.
• Quick Assist, AnyDesk or ScreenConnect starting on a PC without a ticket.
• Help desk reset requests that were not verified.
• In Entra ID logs, a new MFA method added soon after a reset.

How to fix or prevent it

1. Tell staff: IT will never ask for a password or MFA code, and you can always hang up and call back on the number on the intranet.
2. Allow remote support only when you started the contact, a rule Microsoft states for Quick Assist.
3. Restrict Teams external access to trusted domains, or block it.
4. Remove or block remote tools you do not use.
5. Give the help desk a strict identity check for resets, with manager or call-back approval for MFA changes.
6. Use phishing-resistant MFA on admin and finance accounts.
7. Alert on new MFA registrations and new remote tools.
8. Practise with simulations.

Related terms

• Vishing
• Pretexting
• Quick Assist abuse
• Tech support scams
• MFA fatigue attack
• Callback phishing

FAQ

How do attackers pretend to be IT support?
By phone, email or Teams, often after flooding a mailbox with spam so that an offer of help seems welcome.

What should staff do if IT calls unexpectedly?
Hang up and call the help desk back on a known number. Microsoft says to allow Quick Assist only if you started the contact.

Which group did Microsoft link to this tactic?
Storm-1811, which Microsoft linked to Black Basta ransomware.

Sources

• https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/
• https://www.cisa.gov/sites/default/files/2023-11/aa23-320a_scattered_spider_0.pdf
• https://www.ic3.gov/CSA/2025/250729.pdf
• https://attack.mitre.org/groups/G1046/

How Wolfcore helps

Phishy runs realistic phishing simulations against your own staff and shows you who clicked, so you can train the people attackers target. See Phishy phishing simulation.