Hackers Exploit Microsoft Teams’ Collaboration Features to Impersonate IT Helpdesk Staff

A growing wave of vishing (voice phishing) campaigns in which threat actors abuse Microsoft Teams’ external collaboration features to impersonate IT helpdesk personnel and investigators is now turning to the Microsoft 365 Unified Audit Log (UAL) as a critical forensic data source to reconstruct attack timelines.

The attack chain begins when a threat actor operating from an external or cross-tenant Teams account initiates an unsolicited call or message to a targeted employee, presenting as internal IT support.

Using social engineering, the attacker convinces the victim to execute attacker-provided commands, approve remote access sessions, or install Remote Monitoring and Management (RMM) tooling such as Quick Assist.

Because the interaction occurs within a seemingly trusted collaboration platform rather than email, traditional phishing defenses frequently fail to intercept the intrusion.

Microsoft’s Detection and Response Team (DART) documented a campaign built on persistent Teams voice phishing as far back as November 2025, noting that the attack path has been observed across multiple enterprise environments.

Black Basta ransomware affiliates were among the first documented threat actors to weaponize this technique at scale in 2024, combining Teams impersonation with credential theft via EvilProxy and SystemBC persistence tools.

UAL as a Forensic Weapon

Security researcher Maurice Fielenbach, currently investigating multiple active incidents, highlights the CallParticipantDetail operation logged under the MicrosoftTeams workload in the UAL as a pivotal artifact.

This event records participant identity, join and leave timestamps, connection metadata, tenant of origin, and federated or external indicators. However, the precise schema varies by tenant and ingestion path, meaning analysts must validate field availability before building automated detections.

Fielenbach cautions that ChatCreated is not a reliable Teams-client signal; its absence does not confirm that a chat never occurred. Audit records typically surface within 60 to 90 minutes with no guaranteed SLA, and default retention is 180 days.

To reconstruct a complete attack timeline, investigators must correlate CallParticipantDetail with related events including MessageSent, MessageCreatedHasLink, and endpoint telemetry.

For investigations requiring message body content, standard UAL queries are insufficient — Microsoft eDiscovery and Content Search workflows are required.

Detection and Mitigation

The following defensive measures are recommended for security teams:

• Restrict external Teams federation — limit cross-tenant communication to only users or groups with a documented business need.
• Triage first-contact external activity — treat any unsolicited external Teams call or message, especially when followed by URL sharing, Quick Assist launch, or script execution, as a potential vishing indicator.
• Leverage UAL for message and URL visibility — use Search-UnifiedAuditLog with -RecordType MicrosoftTeams and combine with endpoint telemetry for a full kill-chain view.
• Monitor enrichment signals — where available, review TeamsImpersonationDetected and SecurityRiskInCallDetected events as supplementary threat indicators.
• Block Quick Assist where unnecessary — remove or disable legacy remote access tools that lack modern authentication.
• Enforce out-of-band verification — train employees to confirm all IT support requests through a known internal channel before granting remote access.

This attack class is significant because it exploits user trust in enterprise collaboration platforms rather than email, an attack surface many organizations have under-monitored.

As Teams becomes a primary communication channel for hybrid workforces, the CallParticipantDetail log and correlated UAL artifacts are emerging as foundational evidence sources in incident response provided analysts understand their limitations and validate field schemas before operationalizing them in detection pipelines.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates.