Since early 2026, Microsoft Teams-based phishing attacks have surged, primarily involving threat actors impersonating IT Support and Helpdesk teams to deceive users into granting remote access to their devices. These attacks often commence with email bombing, followed by direct interaction with users under the pretense of providing assistance. The overarching goal is to gain remote access, enabling attackers to exfiltrate sensitive data and deploy further malware, including ransomware, to maintain persistence within the compromised systems.