Hackers Impersonate Microsoft Teams Helpdesk to Trick Users into Malware Installation

You’re sitting at your desk in downtown Austin, the late afternoon sun glinting off the Frost Bank Tower, when your Microsoft Teams pings. It’s a message from someone claiming to be from your company’s IT helpdesk. They’re offering to fix an issue with your email—something about a sudden flood of spam overwhelming your inbox. The message looks legitimate, complete with your company’s logo and a professional tone. You click the link they provide, thinking nothing of it. Within minutes, your credentials are stolen, and a custom malware suite called “Snow” is quietly installing itself on your machine. This isn’t a hypothetical scenario. It’s happening right now, and Austin—along with cities across the U.S.—is in the crosshairs.

Cybercriminals have perfected a new playbook: impersonating IT helpdesk staff via Microsoft Teams to trick employees into granting remote access. Once inside, they move laterally through networks, exfiltrate data, and deploy ransomware—all while appearing as routine IT support. The tactic isn’t just sophisticated; it’s alarmingly effective. And in a city like Austin, where tech startups, government agencies, and healthcare providers thrive, the stakes couldn’t be higher.

The Anatomy of a Modern Cyber Heist

This isn’t your grandfather’s phishing scam. The attackers behind these campaigns, including a previously undocumented group called UNC6692, are leveraging a multi-stage approach that combines social engineering with technical precision. Here’s how it unfolds:

First, the criminals launch a “large email campaign” designed to flood a target’s inbox with spam. The goal isn’t just to annoy—it’s to create a false sense of urgency. Imagine an employee at a mid-sized Austin tech firm suddenly receiving hundreds of emails in a matter of minutes. Panic sets in. Then, like clockwork, a Microsoft Teams message arrives from someone posing as IT support. The message is polite, professional, and tailored to the victim’s distress. “We’ve detected an issue with your mailbox due to the recent spam surge,” it might read. “One can assist you resolve this. Would you be available for a quick remote session?”

The timing is no accident. In some cases, the Teams chat arrives just 29 seconds after the email bombardment begins. The attackers are counting on the victim’s stress to override their skepticism. And it works. According to reports from Google-owned Mandiant, victims are often tricked into installing legitimate remote monitoring and management (RMM) tools like Quick Assist or Supremo Remote Desktop. These tools, designed for IT professionals to troubleshoot issues, become the attackers’ gateway into the network. Once inside, they deploy additional payloads—including the custom “Snow” malware—while blending in with normal IT activity.

What makes this tactic particularly insidious is its reliance on trust. Employees are conditioned to follow IT’s instructions, especially when the request comes through an official-looking channel like Microsoft Teams. The attackers exploit this trust, using it to bypass traditional security measures. And because they’re using legitimate tools, their activity can fly under the radar until it’s too late.

Why Austin Is a Prime Target

Austin’s reputation as a tech hub isn’t just a point of pride—it’s a magnet for cybercriminals. The city is home to a mix of Fortune 500 companies, government contractors, and fast-growing startups, all of which handle sensitive data. The University of Texas at Austin, Dell Technologies, and the Texas Department of Information Resources (DIR) are just a few of the high-profile entities that make the city a lucrative target. But it’s not just the big players at risk. Compact businesses, healthcare providers, and even local government offices are increasingly vulnerable to these kinds of attacks.

Consider the recent growth in Austin’s healthcare sector. Hospitals like Ascension Seton and St. David’s HealthCare store vast amounts of patient data, making them prime targets for data exfiltration. Similarly, the city’s booming fintech scene—home to companies like Kasasa and Self Lender—handles financial information that cybercriminals would love to get their hands on. The more data an organization has, the more attractive it becomes to attackers.

But the risk isn’t just about the data. It’s about the interconnectedness of Austin’s economy. A breach at one company can have ripple effects across the city. For example, if a local IT managed service provider (MSP) is compromised, the attackers could use that access to infiltrate multiple clients. This “supply chain” approach is becoming increasingly common, and Austin’s tight-knit business community makes it particularly susceptible.

The Human Element: Why Social Engineering Works

At its core, this attack relies on one thing: human psychology. The criminals behind UNC6692 and similar groups understand that people are more likely to comply with a request when they’re stressed, distracted, or confused. The email bombardment is designed to create that stress. The Teams message is designed to exploit it. And the fake “Mailbox Repair Utility” landing page—complete with a “Health Check” button—is designed to reinforce the illusion of legitimacy.

One particularly devious trick involves the credential-harvesting process. After the victim enters their email and password, the phishing page rejects the first two attempts as incorrect. This isn’t a glitch—it’s a psychological tactic. By forcing the user to re-enter their credentials, the attackers ensure they capture the password twice, reducing the risk of typos. It similarly reinforces the victim’s belief that the system is legitimate. After all, if it’s rejecting incorrect passwords, it must be real, right?

This level of sophistication isn’t accidental. The attackers have studied how people interact with technology, and they’ve designed their approach to exploit those behaviors. It’s a reminder that cybersecurity isn’t just about firewalls and encryption—it’s about understanding human nature.

The Broader Trend: A Playbook That Won’t Quit

UNC6692’s tactics aren’t entirely new. They bear a striking resemblance to those used by former affiliates of the Black Basta ransomware group, which shut down its operations early last year. Despite the group’s demise, its playbook has lived on, adapted and refined by new threat actors. This is the nature of cybercrime: tactics evolve, but the underlying strategies remain the same.

What’s concerning is how quickly these attacks are proliferating. According to a report from ReliaQuest, this approach is being used to target executives and senior-level employees for initial access into corporate networks. The goal isn’t just data theft—it’s lateral movement, ransomware deployment, and extortion. In other words, these aren’t one-off phishing attempts. They’re the first step in a coordinated, multi-stage attack designed to inflict maximum damage.

The shift toward targeting executives is particularly worrisome. High-level employees often have access to sensitive information and broader network permissions. A successful breach at this level can give attackers the keys to the kingdom. And because executives are often pressed for time, they’re more likely to overlook red flags in the interest of efficiency. It’s a perfect storm of opportunity for cybercriminals.

How Austin Can Fight Back

So, what can be done? The fine news is that there are steps organizations—and individuals—can take to protect themselves. The bad news is that there’s no silver bullet. Cybersecurity is a layered defense, and it requires vigilance at every level.

First, organizations need to prioritize employee training. Phishing simulations and security awareness programs can help employees recognize the signs of a social engineering attack. But training alone isn’t enough. Companies also need to implement technical controls, such as multi-factor authentication (MFA) and endpoint detection and response (EDR) tools. Microsoft Defender, for example, can help detect anomalous activity across Teams, endpoints, and identity telemetry.

Second, organizations should limit the use of external Teams invitations. If employees only expect to receive Teams messages from internal accounts, any external message should be treated as suspicious. This simple policy change can significantly reduce the risk of impersonation attacks.

Finally, companies need to have a response plan in place. If an attack does occur, time is of the essence. The faster an organization can detect and contain a breach, the less damage it will cause. In other words having a dedicated incident response team, either in-house or on retainer, ready to spring into action at a moment’s notice.

For Austin Residents: Here’s What You Can Do Today

If you’re reading this in Austin, you might be wondering what you can do to protect yourself—whether you’re an employee, a business owner, or just someone who wants to stay safe online. The answer starts with awareness. Understand that these attacks are happening, and they’re targeting people just like you. But awareness alone isn’t enough. You also need to take action.

Start by enabling MFA on all your accounts. This adds an extra layer of security, making it harder for attackers to gain access even if they steal your password. Next, be skeptical of unsolicited messages, even if they appear to come from a trusted source. If something feels off, it probably is. Take the time to verify the sender’s identity before clicking any links or downloading any files.

If you’re a business owner, consider investing in a cybersecurity assessment. Many local firms offer these services, and they can help you identify vulnerabilities in your network before attackers do. And if you’re an employee, don’t be afraid to report suspicious activity to your IT department. It’s better to be safe than sorry.

Given My Background in Cybersecurity Journalism, Here’s Who You Need in Austin

If this trend has you concerned—and it should—you’re not alone. The good news is that Austin has a robust ecosystem of professionals who can help. Based on my experience covering cybersecurity and digital threats, here are the three types of local experts you should consider connecting with:

Boutique Cybersecurity Consultants

These are the specialists who can assess your organization’s vulnerabilities and recommend tailored solutions. Look for firms with experience in:

• Social engineering testing (e.g., simulated phishing attacks to gauge employee awareness).
• Endpoint detection and response (EDR) implementation, particularly tools that integrate with Microsoft 365.
• Incident response planning, including tabletop exercises to prepare for a breach.

When hiring, ask for case studies or references from similar-sized organizations in Austin. A good consultant should be able to demonstrate their impact, whether it’s reducing phishing click rates or shortening incident response times.

Managed Security Service Providers (MSSPs)

For smaller businesses or organizations without in-house IT teams, an MSSP can provide 24/7 monitoring and threat detection. Key criteria to look for:

• Experience with Microsoft Teams security, including the ability to detect and block external impersonation attempts.
• A track record of working with Austin-based clients, particularly in industries like healthcare, fintech, or government contracting.
• Transparent reporting and communication—you should never be left in the dark about potential threats.

Ask potential providers about their response times for critical incidents. In cybersecurity, minutes matter, and you need a partner who can act fast.

Local IT and Compliance Lawyers

If a breach does occur, you’ll need legal guidance to navigate the aftermath. Austin has a growing number of attorneys specializing in cybersecurity and data privacy law. Look for professionals who:

• Are familiar with Texas-specific regulations, such as the Texas Identity Theft Enforcement and Protection Act.
• Have experience working with the Texas Attorney General’s office, which handles data breach notifications.
• Can advise on compliance with federal laws like HIPAA (for healthcare providers) or GLBA (for financial institutions).

Don’t wait until a breach happens to find a lawyer. Proactive legal counsel can help you draft incident response plans and ensure you’re meeting all regulatory requirements before an attack occurs.

Each of these professionals plays a critical role in Austin’s cybersecurity ecosystem. The key is to find the right fit for your organization’s size, industry, and risk profile. And remember: cybersecurity isn’t a one-time fix. It’s an ongoing process that requires vigilance, adaptation, and the right partners.

Ready to find trusted professionals? Browse our complete directory of top-rated cybersecurity experts in the Austin area today.