Imagine receiving a message on Microsoft Teams from someone claiming to be part of your company’s IT or helpdesk team. They tell you there is a problem with your computer, your account may have been compromised or your device needs urgent attention. The request may not seem unusual because IT support is a normal part of working in a digital workplace. But what if the person sending the message is not actually from IT?

Microsoft Threat Intelligence has identified an attack campaign where attackers impersonate IT and help desk staff through Microsoft Teams. Instead of relying only on technical vulnerabilities, these attackers use social engineering to gain something equally valuable which is an employee trust.

When Trust Becomes the Target

Cybersecurity is often associated with malware, suspicious links or sophisticated hacking techniques. However, some attacks can begin with something much simpler with just a conversation. By pretending to be someone from IT, attackers can make an unusual request appear like a normal workplace task. They may claim that an employee’s device needs to be checked or that remote access is required to solve a technical issue. The goal is to convince the employee that the request is legitimate and persuade them to grant access to their device. Once access is obtained, attackers may use legitimate tools to deploy malware, investigate the organisation’s environment and potentially move towards other systems.

This is what makes social engineering difficult to deal with. The attackers are not only trying to get past a security system. They are trying to get past the person using it.

Why This Matters to Businesses.

The risk does not necessarily stop at one employee’s computer. A work device may provide access to corporate credentials, internal applications and sensitive information. If that device is compromised, it could potentially become an entry point into other parts of the organisation. For fintech organisations, this can be particularly important because employees may work with financial systems and sensitive business information. A single unexpected message can therefore create consequences beyond one device or employee. That is why cybersecurity is not only the responsibility of the IT department. It involves everyone in the organisation.

What Should You Do When “IT” Messages You?

Employees do not need to become cybersecurity experts to take basic precautions. Sometimes, the most important step is simply knowing when to pause.

• STOP before clicking links, downloading software or granting remote access. Consider whether the request was expected and whether it makes sense.
• VERIFY the request through a known and trusted internal IT channel. Do not rely only on the person or account that sent the unexpected message.
• REPORT anything suspicious to your organisation’s IT or cybersecurity team so the request can be properly investigated.

Most importantly, never provide remote access, passwords, or MFA codes to an unexpected contact.

Cybersecurity Is Also About People

Platforms such as Microsoft Teams make workplaces more connected and productive. But at the same time trust that makes these platforms useful can also be exploited. A message does not become trustworthy simply because it comes through a familiar workplace platform. Sometimes, attackers do not need to break through the system. They just need someone to open the door.

Stop. Verify. Report.

‍