Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Reported 03 Sep 2026 by otx · Severity: medium

Microsoft Threat Intelligence observed a sophisticated human-operated campaign exploiting Microsoft Teams external collaboration features to impersonate IT helpdesk personnel. Attackers socially engineer users into granting remote access via legitimate remote monitoring tools. On