A Microsoft Teams call is not proof that the caller is IT.
A familiar Teams call can become an attacker's remote session. Verify the person before granting access.
Read articleThreats targeting identity support workflows.
Research and practical guidance for caller verification, account recovery, enrollment, and other sensitive identity operations.
Your mother's maiden name is not verification.
A caller knowing personal details does not prove that the person on the line controls an organization-managed authenticator.
Read articleMicrosoft Entra Verified ID was built for identity verification.
Authentication factors help establish account control. Verified ID lets an employee present trusted identity evidence when a workflow needs to verify who they are.
Read articleUNC6671 is calling employees at financial firms and posing as IT.
Mandiant says the callers reach personal phones, spoof helpdesk numbers, and use urgent passkey or MFA changes to move employees into attacker-controlled flows.
Read articleThe signals looked legitimate. The person was not verified.
A real prompt, a Microsoft Teams message, or Microsoft-hosted infrastructure can still be part of an attacker-directed support interaction.
Read articleEmail bombing creates the crisis. Fake IT support arrives with the fix.
An inbox flood makes the employee want help. Attackers exploit that moment by impersonating IT and offering remote support.
Read articleThe sign-in page was real. The caller wasn't.
A request to update a passkey can be the pretext for device-code phishing. A real sign-in page does not verify the IT caller.
Read article
ClickFix and fake IT support: before you run the fix.
Employees should not have to inspect a script to decide whether the person asking them to run it is really IT.
Read articleThe unlock button should come after verification.
Provider permissions determine who can unlock an account. They do not verify the employee asking for that action on the phone.
Read article