// Microsoft 365MEDIUM
Cybercriminals are conducting active social engineering attacks via Microsoft Teams, impersonating IT help desk staff to trick employees into installing malware (SynkLoader), granting remote access, or revealing Windows passwords via fake lock screens. Attackers leverage Microsoft 365 tenants they control to contact users through Teams external chat. The campaign exploits default cross-tenant communication settings and employee trust in internal support channels; no software vulnerability is involved. Organizations are advised to restrict Teams external access to trusted domains only and train employees to verify unexpected support requests.
// Get alerts for Microsoft 365