Fake IT support calls on Microsoft Teams end in Chaos ransomware

Sophos detailed a campaign, tracked as STAC4749, in which attackers impersonate IT help desk staff over Microsoft Teams to talk employees into granting remote access, then deploy Chaos ransomware. Using external Teams accounts, the operators start chats and voice calls claiming to fix an urgent problem, persuade the target to open a remote support session, and run PowerShell to pull down a modular toolkit for persistence and lateral movement. Between February and June 2026 they hit dozens of North American organizations, about 95 percent in the US and Canada, across services, manufacturing, energy, and construction. In one case they went from first contact to encrypting files in under seventeen hours.

Check

Restrict or block messages and calls from external Microsoft Teams accounts, and tell staff that real IT support will not cold-call them over Teams to request remote access.

Affected

North American organizations whose staff can be reached by external Teams accounts; attackers posing as IT support talk employees into remote access, then move laterally and deploy Chaos ransomware, sometimes within hours.

Fix

Lock down external Teams contact, train staff to verify support requests through known channels, monitor for unexpected remote-access tools and suspicious PowerShell, and audit startup and registry entries for persistence.