Skip to main content
Apexward Pulse
Type Incident

Microsoft · Ransomware

Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware

1 source

At a glance

Low
30-day window, from the last update
Evidence-weighted, not popularity
Why Low

Low rather than Medium: exposure is scored at a default because we cannot see your systems or suppliers. If you run or depend on Microsoft Teams, treat it as Medium.

Briefing

  • Do not treat uncorroborated claims as confirmed breaches.

Questions to ask IT

  • Do we use Microsoft Teams, and has anything unusual been seen on it?
  • Would our monitoring spot an attack like this, and who would we call if it did?

Next steps

  1. Confirm whether this affects systems or suppliers in your estate

Summary

  • Exploitation in the wild is not confirmed; treat this as a prioritisation signal.

Read the original reportThe Hacker News(opens in a new tab)

Products and services involved

Pulse

Last checked yesterday · Recheck overdue since 8 Nov 2026, 06:36 UK time · 2 quiet checks collapsed

  1. Story26 Oct 2026, 16:52 UK time · 26 Oct

    Linked reporting from The Hacker News (independent original reporter).

    Read source (The Hacker News)

1 entry so far. The timeline chart appears once this story has more history.

Sources

How we know

Statements extracted from sources. Higher confidence means stronger corroboration.

  • ClaimedHeadline60% confidence

    Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware