Microsoft Teams Support Call Leads to Quick Assist Compromise in New Vishing Attack

Microsoft DART investigated a November 2025 vishing campaign in which attackers impersonated IT via Microsoft Teams to trick a user into granting Quick Assist remote access, leading to credential theft through a spoofed portal and deployment of a malicious MSI that sideloaded a DLL to establish C2 and deliver encrypted loaders, remote execution, proxying, and session hijacking. The intrusion was short-lived and contained; DART recommended restricting inbound Teams communications from unmanaged accounts, auditing/disabling unnecessary RMM tools like Quick Assist, conducting vishing awareness training, and enabling conditional access and session anomaly detection.