--- title: When “Hi, This Is IT” Comes Through Microsoft Teams description: Attackers are increasingly using Microsoft Teams to impersonate IT support staff and trick employees into approving MFA prompts or surrendering credentials.... canonical: https://daily.dev/posts/when-hi-this-is-it-comes-through-microsoft-teams-teyqlhqzj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: When “Hi, This Is IT” Comes Through Microsoft Teams | daily.dev og:description: Attackers are increasingly using Microsoft Teams to impersonate IT support staff and trick employees into approving MFA prompts or surrendering credentials.... og:url: https://daily.dev/posts/when-hi-this-is-it-comes-through-microsoft-teams-teyqlhqzj og:image: https://api.daily.dev/og/posts/TEYqlhQzJ.png og:image:alt: When “Hi, This Is IT” Comes Through Microsoft Teams og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # When “Hi, This Is IT” Comes Through Microsoft Teams **[Unit 42](https://daily.dev/sources/unit42)** · 7 min read · 0 upvotes · 0 comments ## Summary Attackers are increasingly using Microsoft Teams to impersonate IT support staff and trick employees into approving MFA prompts or surrendering credentials. Phishing alerts from collaboration tools rose to 42% of all phishing alerts in early 2026, up from 30% the prior period. Threat actors exploit permissive Teams federation settings and typosquatted domains to appear legitimate. Key defenses include restricting external chat federation to an allowlist of trusted domains, disabling communication with unmanaged accounts, extending phishing awareness training to cover Teams-based attacks, implementing Conditional Access policies, and monitoring for external chat initiation from unknown domains followed by authentication anomalies. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/when-hi-this-is-it-comes-through-microsoft-teams-teyqlhqzj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"When “Hi, This Is IT” Comes Through Microsoft Teams","url":"https://daily.dev/posts/when-hi-this-is-it-comes-through-microsoft-teams-teyqlhqzj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/when-hi-this-is-it-comes-through-microsoft-teams-teyqlhqzj"},"datePublished":"2026-06-08T23:09:25.644Z","dateModified":"2026-06-08T23:09:50.876Z","description":"Attackers are increasingly using Microsoft Teams to impersonate IT support staff and trick employees into approving MFA prompts or surrendering credentials....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b018c7942ab250f7620bb97e804a2de6?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b018c7942ab250f7620bb97e804a2de6?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Unit 42","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Unit 42","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/5b55ca8d2ae04181939041fbc9d78160","url":"https://daily.dev/sources/unit42"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/when-hi-this-is-it-comes-through-microsoft-teams-teyqlhqzj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,authentication,phishing","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Unit 42","item":"https://daily.dev/sources/unit42"},{"@type":"ListItem","position":3,"name":"When “Hi, This Is IT” Comes Through Microsoft Teams"}]} ```