Attackers are increasingly exploiting enterprise collaboration platforms such as Microsoft Teams to gain initial access, impersonating IT helpdesk staff and persuading employees to grant remote control, according to new research from Microsoft.
In a blog post, Microsoft described a “cross-tenant helpdesk impersonation” technique in which threat actors initiate conversations with employees via Teams’ external access feature.
“Attackers use social engineering to convince users to grant access,” Microsoft said, noting that the approach allows adversaries to operate within trusted communication channels and bypass traditional phishing defenses.
Unlike conventional phishing or exploit-driven attacks, the technique relies on what Microsoft characterizes as user-approved access. Victims are persuaded to initiate remote sessions, often using legitimate tools, effectively handing control to attackers without triggering typical malware-based detections, the blog post said.
Shift to collaboration apps
While the technique may appear new, analysts say it reflects an evolution rather than a reinvention of attack methods.
“From my perspective, this is more an evolution of existing social engineering tactics than a fundamental shift,” said Prabhjyot Kaur, senior analyst at Everest Group. “The underlying objective hasn’t changed. Attackers are still exploiting user trust and urgency to gain initial access. What is changing is the channel.”
As platforms such as Teams become central to workplace communication, attackers are following users into those environments. Unlike email, these platforms enable real-time engagement, making impersonation of IT or helpdesk staff more convincing.
Kaur said collaboration platforms enable real-time interaction, making impersonation of IT or helpdesk staff more convincing than email-based phishing. “So rather than replacing phishing, this expands the attack surface and makes social engineering more operationally effective,” Kaur said.
Offering a sharper view of the shift, Sanchit Vir Gogia, chief analyst at Greyhound Research, said the change is less about channel and more about how attacks unfold. “Phishing asked for attention. This model demands participation,” he said.
“Attackers are inserting themselves into legitimate workflows and guiding users step by step through actions that grant access,” Gogia added, describing it as a move toward “guided execution” rather than simple deception.
Microsoft’s findings follow earlier incidents in which attackers used Teams chats and calls to impersonate IT support and initiate remote access.
Cross-tenant risk grows
The attack chain uses Teams’ cross-tenant communication capability, which allows external users to initiate chats with employees, Microsoft wrote in the blog.
“The cross-tenant risk is significant, and many organizations probably do underestimate it,” said Sunil Varkey, advisor at Beagle Security.
“Collaboration tools were designed to reduce friction, but many organizations enabled that convenience before fully applying Zero Trust controls,” Varkey said. “The sustainable approach is to keep the business value of these platforms while treating every external interaction, support request, and access approval as something that must be verified, limited, and monitored.”
He compared the risk to a physical security gap. Allowing anyone into a lobby should not mean they can walk employees to restricted areas and request access.
Kaur added that many enterprises still treat collaboration platforms primarily as productivity tools rather than part of their attack surface. “Cross-tenant access is necessary for business, but it introduces a trust boundary that is often not well understood or tightly controlled,” she said.
Gogia said the issue is rooted in how trust is applied in modern environments. “External actors can now initiate interactions inside environments that employees associate with internal coordination,” he said, adding that this creates a “false sense of safety.”
Detection becomes harder
Microsoft said attackers use legitimate administrative tools and remote access utilities after gaining entry, making activity harder to distinguish from normal operations.
Because attackers use legitimate tools and approved workflows, “there’s very little that looks overtly malicious in isolation,” Kaur said. “These attacks blend into normal IT operations.”
Microsoft also noted that attackers rely on native administrative tools and legitimate data transfer utilities to move laterally and exfiltrate data while appearing as routine activity.
This shifts the focus toward behavioral detection. “Security teams should prioritize detecting sequences of activity,” Kaur said, pointing to patterns such as an unsolicited external Teams interaction followed by remote support activity and lateral movement.
Gogia said this requires a shift in detection approach. “These attacks do not rely on exploits. They rely on sequence,” he said. “Each individual action appears legitimate. The compromise emerges only when those actions are connected.”
Varkey added that defenders need to move beyond traditional indicators. “Because these attacks rely on legitimate tools and user-approved actions, security teams need to focus on context and behavior, not just malware,” he said.
Tighter controls needed
To reduce risk, experts say organizations need stronger governance over collaboration environments.
“Collaboration platforms are often configured for convenience first, with easy external chat, calls, screen sharing, and remote assistance, without fully considering how those features can be abused together,” Varkey said.
Kaur emphasized the need for integrated visibility. “The most effective defenses will come from integrating collaboration, identity, endpoint, and SOC visibility rather than treating them as separate layers,” she said.
Recommended measures include tightening external access controls, restricting remote-support tools to approved workflows, enforcing conditional access and multi-factor authentication, and improving user awareness around how legitimate IT support interactions occur, Microsoft wrote.