↓Skip to main content
  1. News/

The 'IT Support' Message That Isn't: How Hackers Get In and How to Stop Them

·6 mins
Phishing Social Engineering Microsoft Teams Multi-Factor Authentication Small Business
Table of Contents
A message arrives that looks like it is from your IT help desk. It asks for a password, a sign-in code, or control of the computer. Criminal gangs use this trick, and one security firm says, with moderate confidence, that a group tied to a government has used it too. Here is how it works and what to put in place.

What happened #

In a report published May 6, 2026, the security firm Rapid7 described a break-in that looked like the work of a ransomware gang. (Ransomware locks your files and demands money to unlock them.)

The report says a stranger began one-on-one chats with employees in Microsoft Teams, from an account outside the company. The stranger shared screens with staff and told them to type their passwords into a text file on the computer. Staff were also told to add the stranger’s device to the second step at sign-in. That is the code or approval, often on your phone, that you give after your password.

The attackers then installed remote-control software, which lets someone run a computer from far away. They also added a backdoor, a hidden way back in. They copied data and emailed several employees, saying it was stolen and pushing them to negotiate.

The report says the attackers did not lock any files. It looked like ransomware but did not behave like it. The data was later published online, and the victim confirmed it was real.

Who is behind it #

There are two separate cases here, with two different answers.

In the case above, the first report says, “with moderate confidence,” that the work belongs to a hacking group tied to Iran’s intelligence ministry. It says the ransomware label was a cover. The report rests on technical clues, so it is an assessment, not proof.

The second case is a different campaign, tracked by another firm, Sophos, from February to June 2026. “IT support” chats and calls hit dozens of organizations, almost all in Canada and the United States. In at least three of them, the attackers locked the victims’ files, one in under 17 hours. The firm calls this campaign money-driven, and it found no sign that it was connected to the Iranian group. Its report adds that Microsoft first described this kind of abuse in mid-2024, so the trick is not new.

Microsoft, which makes the chat tool, published related findings on March 16, May 18 and September 2, 2026. The company says the trick is not a flaw in its product. It works when a worker overrides a warning and allows remote access.

The sender changes. The trick does not.

The same trick with sign-in approvals #

The May 18 report says, with high confidence, that one gang used a known trick on the password-reset tool. Its example: someone posing as internal IT tells a worker that an account needs urgent verification. The attacker starts a password reset, which sends sign-in approval requests to the worker. The worker approves them, thinking they are routine.

The report says the attacker then removed the worker’s real sign-in methods and added their own device to the second step. That kept the attacker in and locked the real worker out. IT staff and senior leaders were among those targeted. The report does not say how the first contact was made.

What we do not know #

No source gives a total number of affected businesses. The second firm’s figures cover only its own cases. We do not know whether the two campaigns are related, or who is behind any single case. We cannot say whether your business was contacted.

Five things to ask your IT person #

These are good questions to have answers to. Your IT person or outside IT company should answer them. An owner should not change chat settings alone.

  1. Who from outside our company can message and call our staff in the chat tool? The maker’s own help page says chat with outside companies is allowed by default. Only an IT person can change that. The maker advises allowing only trusted outside companies.
  2. Is the remote-help tool built into Windows (Quick Assist) switched off, and which remote-help tools are allowed? The March report advises removing such tools where they are not needed. The September report advises controlling which ones are permitted.
  3. What is our rule for a request from “IT”? Our rule of thumb: IT never asks for a password or a sign-in code. A worker who gets such a request ignores the chat or hangs up, then calls IT on a number they already have. The September report also suggests a help-desk passphrase.
  4. Who gets told when a new phone or device is added to someone’s sign-in? The May report describes attackers adding their own device. It advises that important accounts already have a sign-in method registered.
  5. What would we do in the first hour if a worker says they shared their screen or typed a password? The September report says to “investigate and rotate credentials,” which means change the passwords. Our own plain list adds checking for sign-in devices nobody recognizes and calling IT right away.

If your business does not use a company chat tool, the same trick can arrive by phone or email. The question “who is allowed to ask for a password?” applies to every business.

Take this to your next IT meeting #

Print the five questions and bring them. At SOC-Lite, a named analyst reviews your alerts, calls you when one is real, works with your IT person or MSP on the fix, and keeps the evidence. A visibility check is free, it takes 20 minutes, and you talk to us by phone or at your office. Book a visibility check

Updates #

  • 2026-11-04: First published, based on the sources below as of this date. We update this post as the details develop.

Sources #