When “Hi, This Is IT” Comes Through Microsoft Teams

This advisory describes an increase in chat-based social engineering via Microsoft Teams—threat actors (including APT29/Cloaked Ursa and UNC6692) use external or compromised tenants, typosquatted domains, and impersonation of IT/helpdesk to trick users into approving MFA prompts or divulging credentials; telemetry shows collaboration-tool phishing rose to 42% of phishing alerts in early 2026. It recommends hardening Teams (restrict federation, block unmanaged accounts), strengthen identity controls (conditional access, JIT privileged access), expand phishing training to collaboration apps, and monitor/report suspicious external chats.