Threat actors are impersonating IT helpdesk staff over Microsoft Teams external chat, then using Microsoft’s own Quick Assist remote access tool to take control of employee workstations. Once inside, attackers install hidden backdoors disguised as legitimate software (Autodesk, Adobe Acrobat), exfiltrate data using Rclone, and cover their tracks using built-in Windows tools. Any organization using Microsoft Teams with external communications enabled is exposed, and successful compromise can result in full network access, data theft, and ransomware deployment.