Zero Radar
← feed
HighSecurity incidentupdated 26 Oct 2026, 17:55 UTC

Fake Microsoft Teams IT support chats are spreading malware and ransomware

Criminals pose as IT support in Microsoft Teams chats and talk people into installing malicious software. That software can lock files for ransom or steal data.

Attacks reported (The Hacker News)1 source, unconfirmed
SeverityHighSecurity incident
Being exploited?ReportedBy The Hacker News, not officially confirmed yet
What to doCheck exposureLimit or disable external chat in Microsoft Teams and warn staff that unsolicited 'IT support' messages are likely scams.
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Fake IT accountThrowaway tenant impersonates IT support
  2. 2External Teams chatMessage reaches employee via external chat
  3. 3Employee trusts itVictim follows the support instructions
  4. 4Malware installedPayload delivered to the device
  5. 5Ransomware or theftFiles locked or data stolen
  6. ResultAttacker gains access to the organization

What happened

Attackers abuse Microsoft Teams' external chat feature, using throwaway tenants to impersonate IT support and deliver malware and ransomware across hundreds of cases.

Why it is dangerous: Employees who trust a message that looks like internal IT can let attackers into their device and network, which can lead to ransomware and data theft.

Are you affected?

You are affected if your organization uses Microsoft Teams with external chat enabled and staff can receive messages from outside users.

What to do

  1. Restrict Microsoft Teams external chat to approved domains or disable it for users who do not need it
  2. Tell staff that IT support will never message them unprompted in Teams to install software
  3. Report and block suspicious external accounts that claim to be IT support

Timeline

  1. 26 Oct 2026, 15:52 UTC
    Publicly disclosed
  2. 26 Oct 2026, 15:52 UTC
    Reported by The Hacker News · The Hacker News
  3. 26 Oct 2026, 17:55 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Security press established security newsrooms

Technical details

ID
ZR-03f54c74
Disclosed
26 Oct 2026, 15:52 UTC
On Zero Radar
26 Oct 2026, 17:55 UTC (2 h after disclosure)
Last change
26 Oct 2026, 17:55 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Fake Microsoft Teams IT support chats are spreading malware and ransomware · Zero Radar