Microsoft Teams Campaign Highlights Risk Around Fake IT Support and Remote Access

Overview

Zscaler ThreatLabz published an analysis of a campaign where attackers use Microsoft Teams, fake IT support calls and Quick Assist to gain remote access to corporate devices.

After the employee approves the session, attackers use PowerShell to download and run GoGRPC — a Go-based backdoor that can collect system information, execute commands and maintain access to the compromised device.

The topic matters because the attack does not begin with a complex software exploit. It begins with trust: an employee receives inbox noise, followed by a convincing Teams message or call from someone pretending to be IT support.

What Happened

According to Zscaler, the campaign was tracked between January and June 2026. The attack often begins with spam flooding, where the victim receives a large number of unwanted emails. While the employee is distracted by the issue, the attacker contacts them through Microsoft Teams and impersonates internal IT support.

The victim is then persuaded to open Quick Assist and approve a remote support session. Once access is granted, the attacker can interact with the device and launch PowerShell commands.

In the observed cases, this was followed by the download and execution of GoGRPC. The malware creates persistence through a Windows Registry Run value, allowing it to launch again when the user signs in.

Why This Matters

This campaign shows how legitimate tools can become an entry point when combined with social engineering.

Microsoft Teams and Quick Assist are normal corporate tools. That is what makes them useful for abuse. The employee may not see anything unusual because the channel looks familiar, and the request arrives at a moment when they already appear to have an email-related “problem.”

The risk is not only the first remote support session. After that, attackers can inspect the environment, collect system information, launch additional tools and assess whether the access is valuable for a next-stage attack.

What Is GoGRPC

GoGRPC is a backdoor that uses gRPC communication over HTTP/2, usually through port 443. This can make traffic harder to distinguish from normal encrypted web connections.

According to Zscaler, several GoGRPC variants were observed, including Lep, Giver, Pet and Kind. They share core functionality but differ in encryption, code obfuscation, victim fingerprinting and command execution features.

The tool can collect data such as computer name, user, domain, Windows version and security software details. This helps attackers assess whether the compromised device can support broader access.

Where the Risk Is for Organizations

The main risk is that the attack passes through a real person and a trusted process. Even a well-protected environment can be bypassed if an employee is convinced to approve a remote session.

Organizations are more exposed when:

• external Teams messages and calls are allowed without restriction;
• Quick Assist can be used freely by all employees;
• there is no clear verification process for IT support requests;
• PowerShell activity is not monitored closely;
• remote sessions are not logged or reviewed;
• employees do not know how to identify fake support.

This attack does not rely only on malware. It relies on a normal business workflow used in the wrong context.

What Should Be Checked

For organizations, the practical review should start with the remote support process.

Security teams should pay attention to:

• unexpected Teams calls or messages from “IT support”;
• Quick Assist use outside approved scenarios;
• PowerShell commands launched after a remote session;
• new Windows Registry Run entries;
• unusual connections over port 443 to unknown domains;
• signs of additional remote access or tunneling tools.

The main takeaway is practical: every unexpected remote support request should be verified through a known internal channel before an employee shares access to their device.

DIAMATIX Perspective

This campaign shows why defence must cover not only technical controls, but also the processes where employees interact with IT support.

DIAMATIX treats cases like this as a risk around identity, remote access and endpoints. The important link is between Teams activity, Quick Assist sessions, PowerShell commands, endpoint behavior and follow-on access to internal systems.

SOC (Security Operations Center) and MDR (Managed Detection and Response) processes need to connect these signals in time, before initial access becomes a more serious incident.

CISO Analysis

For CISOs, the key question is whether the organization has real control over its remote support process.

Key questions to review:

• Are external Teams messages and calls allowed to employees?
• Who is allowed to use Quick Assist?
• Is there a clear verification process for IT support requests?
• Do we monitor PowerShell activity after remote sessions?
• Can we detect new autorun mechanisms?
• Do employees know how to verify whether a support request is real?

The practical takeaway: fake IT support is now a real path to initial access. Control over remote sessions should be part of the security model.

Review risk around remote support and trusted tools

DIAMATIX can help review Teams communication, Quick Assist usage, PowerShell activity and endpoint visibility.

Request a remote access risk review with DIAMATIX.
Trusted · Innovative · Vigilant

Sources

• Zscaler ThreatLabz. Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor.
• Microsoft Security Blog. Help on the line: How a Microsoft Teams support call led to compromise.
• Cyber Security News. Microsoft Teams Vishing Attack Uses Quick Assist to Deploy GoGRPC Backdoor.

This article is based on publicly available information as of July 2026.