Microsoft Teams phishing targets 30% of monitored organizations

A threat intelligence report from Ontinue reveals that approximately 30% of monitored organizations faced fake IT support impersonation attempts via Microsoft Teams during the first half of 2026. The findings, released from Zurich, indicate that attackers are increasingly using voice phishing, or ‘vishing’, to exploit the inherent trust employees place in internal communication tools.

According to the report, roughly one in every 990 external Teams contacts showed signs of IT-support impersonation. These attacks often involve an external user posing as a help-desk representative to claim an urgent security or device issue. Attackers then guide targets to use tools like Windows Quick Assist, AnyDesk, or TeamViewer to gain remote access, or to execute PowerShell commands.

Security professionals noted that successful compromises often rely on patient, long-form conversations—averaging 20 minutes—rather than quick scripts. The report suggests that the perceived safety of chat platforms allows attackers to bypass technical defenses by leveraging human trust.