Phone scamStill active

Fake "IT Support" or "Help Desk" messages in Microsoft Teams ask you to share your screen with Quick Assist

Strangers pose as your company's help desk in Teams, often after a flood of junk email, and ask you to open Quick Assist.

By the Xcelcor Guardian team · Reported October 29, 2026

Is it a scam?: Yes, it's a scam. The "IT Support" account is an outside Teams account run by criminals, not your company's help desk or Microsoft.
Type: Phone scam
First reported: October 26, 2026
Status: Still active
Who it targets: People who use Microsoft Teams at work, in the US and elsewhere, often right after their inbox is flooded with junk email
Tools it uses: Quick Assist, AnyDesk, ScreenConnect, TeamViewer, Microsoft Teams

If someone called "Help Desk" or "IT Support" messages you in Microsoft Teams and asks you to open Quick Assist or read out a code, stop. Researchers at Arctic Wolf reported on October 26, 2026 that they had looked at more than 400 cases where criminals did exactly this to get into people's work computers. The account is not your company's help desk. It's an outside Teams account dressed up to look like one.

What does the fake IT support message look like?

The chat comes from a name that sounds official. Arctic Wolf listed names such as "Help Desk", "IT Support", "HelpDesk Supervisor", "IT Service Desk (Liam)" and "Enterprise IT & Security (Internal)". Some add the word "Internal" to look like they work at your company.

Look closer and the account belongs to another organization. Teams usually marks it External, and the address often ends in onmicrosoft.com with a made-up name, such as helpdeskteam365.onmicrosoft.com or techsupport2337.onmicrosoft.com.

How the scam plays out

It often starts with a flood of junk email. Your inbox suddenly fills with newsletters and sign-up messages you never asked for. Soon after, "IT Support" gets in touch on Teams, often with a voice call, offering to fix the problem.

They ask you to open Quick Assist (it's built into Windows) and read out the six-digit code, or to install AnyDesk, ScreenConnect, TeamViewer or a similar tool. Once connected, they can see and control your computer. Arctic Wolf said the harmful software could be running in under 15 minutes. In one case the person was told to run a command that downloaded a program which went looking through the company network.

Microsoft first described this same mix of email flooding, fake help desk calls and Quick Assist in 2024. The new report shows it is still going on, and that the scammers now also use web addresses ending in .top, such as ms-system-check.top and it-assistant.top. For a longer look at why the trick works, read how the fake Teams help desk chat works.

I got the message but didn't do anything

You're fine. Don't reply, don't accept a call, and don't open Quick Assist. Tell your real IT team using the phone number or ticket system you already know, not a number or link from the chat. Teams also lets you report the account as suspicious.

I gave them the code or let them connect. What now?

Act now, even if nothing seems wrong.

Disconnect the computer from the internet (unplug the cable or turn off Wi-Fi). Don't shut it down unless your IT team tells you to, as they may want to look at it.
Call your real IT or security team from another phone and tell them exactly what you did and when.
From a different device, change your work password and, if you used them on that computer, your email and banking passwords.
If it was a home or personal computer, follow our two-minute checklist and see what to do after a remote access scam.

Nobody who falls for this was careless. The flood of email is designed to make a help desk message feel like a relief.

How to spot it next time

Your IT team doesn't usually message you first and then ask for a Quick Assist code. If they do, check by calling them yourself.
Look for the External label and an address that isn't your company's.
A sudden pile of junk email followed by an offer of help is a warning sign, not a coincidence.
Never read out a Quick Assist code to someone who contacted you first. Our Quick Assist scam guide explains why.

On a home Windows 11 PC, Xcelcor Guardian holds every new Quick Assist, AnyDesk or TeamViewer connection until the account holder approves it by email or on xcelcor.com, so a stranger can't just connect. It doesn't remove malware and won't stop every scam, but it adds a pause where this trick needs speed.

Phone numbers, messages and files linked to this scam

Web addresses are written with [.] so they can’t be clicked by mistake. If something you received matches, it’s this scam.

Websites

helpdeskteam365[.]onmicrosoft[.]comOutside Teams account used by the scammers
supportedge33[.]onmicrosoft[.]comOutside Teams account used by the scammers
techsupport2337[.]onmicrosoft[.]comOutside Teams account used by the scammers
corporateitservicellc[.]onmicrosoft[.]comOutside Teams account used by the scammers
helpdesk-call[.]comHelp desk lookalike site
itdeskassist[.]comHelp desk lookalike site
ms-system-check[.]topDownload site used after access
it-assistant[.]topDownload site used after access

Files

cleaner.ps1Script dropped in one case
archive6.zipBundled with the download in one case

Other signs

Help DeskTeams display name listed by Arctic Wolf
IT SupportTeams display name listed by Arctic Wolf
HelpDesk SupervisorTeams display name listed by Arctic Wolf
IT Service Desk (Liam)Teams display name listed by Arctic Wolf
IT Support (Scott McGhee)Teams display name listed by Arctic Wolf
Enterprise IT & Security (Internal)Teams display name listed by Arctic Wolf
Business IT Solutions & Support (Internal)Teams display name listed by Arctic Wolf

Questions people ask

Would my company's IT team really message me on Teams?

Some do, but the real help desk writes from your own company's account. A message marked External, or from a name ending in onmicrosoft.com that isn't your company, is not your IT team. Call your help desk on the number you already know to check.

They asked me for a six-digit Quick Assist code. Is that normal?

Only if you asked your own IT team for help and you reached them yourself. Giving the code to someone who contacted you first lets them see and control your computer.

I already let them connect. What now?

Disconnect the computer from the internet, then call your real IT or security team straight away from another phone and tell them exactly what happened. Don't wait to see if anything goes wrong.

Can this happen on my home computer?

Researchers saw it mostly at work, because it uses work Teams accounts. The same trick works on any PC with Quick Assist, which is built into Windows, so the rule is the same at home: never open it for someone who contacted you first.

Sources

Last updated October 29, 2026