Slamming the Door on Quick Assist Tech Support Scams and Abuse

This report describes an uptick in social-engineering "tech support" campaigns that use Microsoft Teams calls and Windows Quick Assist (both older and Microsoft Store editions) to obtain remote access; it highlights three Quick Assist outbound URLs as detection indicators, outlines where to find forensic artifacts (proxy logs, browser history, Windows Event Log), and recommends procedural and technical controls such as removing Quick Assist, URL filtering/alerting, AppLocker/EDR denylisting, and user training.