Scammers Pretending to Be IT Support on Microsoft Teams: Protect Your Work Computer

Cybercriminals have started a new scam targeting people at work through Microsoft Teams voice calls. The attackers pretend to be IT support staff from the victim's own company. During these fake support calls, they convince employees to install software that they claim will fix a computer problem. Instead, the software is malware called EtherRAT that gives criminals access to the company's network and allows them to steal information. This threat primarily affects people who use Microsoft Teams for work, especially employees at medium and large companies. If you or someone in your household uses Teams for their job, they could receive one of these scam calls. The criminals are specifically targeting employees to gain access to corporate networks, business data, and company systems. Home users who only use personal email and social media are not the primary targets of this particular scam.

If you use Microsoft Teams at work, follow these steps to protect yourself and your employer:

1. Never install software based on an unsolicited call, even if the caller claims to be from your IT department.
2. If someone calling through Teams asks you to install something, hang up and contact your real IT department using a phone number or email you already have.
3. Remember that legitimate IT staff will usually create support tickets and will not mind if you verify their identity before following instructions.
4. Report any suspicious Teams calls to your company's IT security team immediately.
5. Check with your IT department about their actual procedures for software installation and support requests. This scam works because it exploits trust and creates urgency. Teach your family members who work from home to be skeptical of unexpected technical support offers, even when they come through official work channels like Teams. The same principle applies to phone calls, emails, or messages claiming to be from technical support at banks, internet providers, or other services. Real support teams will not pressure you to act immediately or get upset if you verify their identity through official channels first. Taking a moment to confirm who you are talking to can prevent a successful cyberattack.