Your Inbox Floods, Then Fake IT Support Calls on Teams to Fix the Spam

Your work inbox starts filling with messages you never asked for. Before you can sort them, someone on Teams offers to help.

It sounds like the right call at the right time. That is exactly what makes it worth checking.

Overview

The inbox flood and the Teams call can be part of one incident

The spam arrives first. A call or chat from someone posing as support can follow while an employee is still trying to make sense of it.

Arctic Wolf’s investigation documents misuse of external Teams conversations in more than 400 incidents involving impersonation or malicious files. Email flooding was part of some of the activity it describes.

Microsoft’s investigation documents unsolicited Teams support contacts that used spam filter updates as one pretext to request remote access.

The two companies’ findings are a good reason to report the caller and the spam together.

Your real help desk can check whether the calls and the incoming mail are related.

A call inside the genuine Teams app can still be an impersonation

A Teams call can come from outside your organization. A display name such as “IT Support” gives you little to go on by itself.

Use the same internal channel you normally use for support.

Take a closer look if any of these things happen:

• A caller comes in before you report the issue and can’t be confirmed by your own help desk.
• Teams identifies the sender as external or unfamiliar.
• A caller asks for a screen share or remote control to fix the volume of mail.
• The caller tells you to approve an unexpected prompt or open an attachment in the chat.
• You’re urged to stay on the call instead of checking the company directory or support portal.

Some organizations use outside support vendors. The real team can confirm who provides that support and whether a technician is assigned to you.

What you approved changes what security needs to do

Answering a call, sharing a screen, and giving someone control of a computer are different events.

Tell security which one happened. Include any password or code you entered while the caller was watching.

A screen share can reveal what was visible even if nobody touched the keyboard.

Remote control can allow action on the device. The response team needs to know which it is dealing with.

The spam may be the first thing you notice. Leave the mail and chat records available while IT decides what it needs.

Evidence can make the difference between one report and a recognizable pattern.

How the Scam Works

Step 1: The employee starts receiving unexpected mail

Ordinary-looking confirmations and newsletters can arrive in a burst. It is hard to find a request from a colleague when the inbox keeps filling faster than you can clear it.

Note roughly when this started. Do not click through unsubscribe requests one by one.

Some may be genuine, but there is no need to follow them while you are assessing the incident.

Use another route to support if the inbox is unusable.

A saved help-desk number, internal portal, or company directory can get you to the right place without relying on any new message.

Someone may find a security alert buried just before or during the flood. Record what you find and send it to IT using the method they give you.

Step 2: A caller offers to clear the spam

A message can seem helpful simply because it describes the problem you are experiencing. If the caller contacts you first, give yourself permission to end the call and check.

Call your real help desk. Say when the incoming email started and when the caller appeared.

Ask if there is an existing ticket and whether they sent someone to contact you.

If a suggested staff name matches an entry in your directory, use the number or Teams contact listed there to reach them.

The display name in an incoming chat can be misleading.

There is no need to debate authenticity with the caller. The help desk can verify the work request through a separate conversation.

Step 3: The caller asks you to approve access

The request might sound like something you have done for support before. If the work has not been confirmed, do not start screen sharing or approve control.

In the moment, it is easy to focus on making the mail stop.

That does not explain why a person you have never verified should see your desktop or move your cursor.

The same caution applies to unexpected approval notifications. If one appears, record what it says and tell company security. Approve only a request you initiated and expected under company procedure.

If you opened a file from the chat, give IT its name and the approximate time.

Leave it where it is and wait for their instructions instead of opening it again.

Step 4: The requested access outlasts the call

A call can end before you know what the other person saw or did.

Tell security when the session started and ended and whether the cursor, settings, or programs changed without you.

If unverified remote access is active, end the session if safe and call IT from another device.

Follow company policy on disconnecting the affected device from its network. Keep it available for responders.

If a login, document, or customer record was on your screen, say so.

Include work accounts you had open and identify any connected devices or shared files the responder should ask about.

Microsoft’s report describes incidents with a wider impact after remote sessions. The appropriate recovery is determined by your organization’s investigation. A stopped chat cannot establish that access ended everywhere.

What to Tell the Real Help Desk

A short timeline is more useful than a guess about how the caller got your name.

Start with the first spam, the contact, and whether you clicked, approved, shared, or typed anything.

If the message is still accessible, save the displayed sender and timestamp through your organization’s approved reporting route. Some work conversations contain information that should stay inside the company.

If a coworker mentions a similar flood, ask them to report it through the official channel too.

One common source or sequence can be easier to see when several reports reach the same team.

Mention ordinary business messages you are expecting, especially invoices or account notices. If something appears to have changed, verify it directly while the help desk checks the mail.

Wait for guidance on recovering the inbox. Bulk deletion can remove useful records or legitimate mail. Use the organization’s approved cleanup process once security no longer needs the messages.

If a Payment or Account Notice Was Buried in the Spam

Tell finance if you were expecting an invoice, payroll message, or expense approval. Use a known contact outside the cluttered inbox.

If you were expecting a payment change, confirm it under your company’s normal procedures. A screenshot in the flood or a note from the unsolicited caller cannot confirm approval.

Check order, expense, or account status inside the service you use. If you find an unfamiliar transaction, report it to the responsible team and give security the timestamp.

A vendor might have sent a genuine reminder just before the spam. Find their established contact if the response is time-sensitive. Start a new conversation through that channel.

Keep a short list of deadlines and incoming approvals you still owe. This helps you pick up normal work without treating the first messages you find as safe.

For Managers Who Receive the First Report

Tell the employee how to reach security without using the jammed inbox. If your company already has an incident channel or hotline, use it.

Pass along when the employee noticed the spam and what the caller could see or control.

Avoid asking the employee to reopen an attachment, restart a session, or reproduce an approval.

If an exposed document contained customer information, pass that fact to the team responsible for it. The employee can name the file without copying customer data into chat.

If someone else reports the same call, keep the reports distinct. Ask what access each person approved. Do not assume everyone saw the same prompt or took the same action.

Remind the team how a genuine technician will get in touch while the incident is active.

If employees know the verified number or portal, an unexpected callback is easier to check.

When work resumes, tell affected employees whether missing mail needs a manual check and who can help. Some may have moved messages into a folder before they reported the incident.

What to Do if You Have Fallen Victim to This Scam

If an unverified person is still connected, stop sharing and get in touch with IT immediately.

Use a different device to report the incident if the work machine may be affected.

1. End the conversation. Stop the share or session if you can do so safely. Ignore any callback from the same chat or caller.

2. Reach the real help desk. Use the company portal or directory. Describe both the inbox flood and the unverified Teams contact.

3. Describe the access you provided. Say whether you answered, shared your screen, allowed control, opened a file, or exposed credentials.

4. Preserve the records. Give security the times, chat information, and any prompts you saw through the approved reporting process.

5. Secure affected accounts with IT. Ask whether to use a trusted device to reset a password or revoke sessions. Follow your organization’s instructions.

6. Resume work when cleared. Ask when to reconnect or use your device again and how to sort the spam safely once the investigation permits it.

On a company-managed device, follow IT’s instructions. Installing a scanner or cleaning up files on your own while responders are working can get in their way.

If the call affected an unmanaged personal computer, a scan with Malwarebytes can help check for malware after you end access and report any work accounts that were exposed.

AdGuard can help block known malicious web destinations on supported devices.

Its web protection does not verify who is calling you in Teams or stop someone you have already given remote control.

Save the help-desk ticket number. If another person contacts you about the incident, check in the same portal or call the same verified number before giving them any information.

Frequently Asked Questions

Can the call be fraudulent even if it appears in the real Teams app?

Yes. Teams is a real communications app, and people outside your workplace can reach you where the organization allows it. Confirm the caller using your usual help-desk contact.

Ask your support team to verify whether it called you about this specific issue. The answer is more useful than whether the display name looks like somebody’s normal title.

Does the inbox flood mean my mailbox password was stolen?

The incoming mail alone cannot establish that. Anyone who has an email address may be able to trigger unwanted mail.

Use sign-in records and verified provider alerts to assess account access.

Report the flood and the call together even if you see nothing unusual in your account. Let company security determine whether any events need to be investigated together.

What if I answered but never shared anything?

Tell IT what was said and record the time. If you gave no information and approved no access, say that clearly.

Ask whether the chat should be reported inside Teams too.

Review any prompt that appeared during the call with your support team. If you unexpectedly received a sign-in notification, report it even if you rejected it.

What if I shared my screen and did not grant control?

Give IT a list of what could be seen, including open documents or an account page.

If you entered a password or verification code during the share, report that as well.

Security may ask for times and the names of affected apps. Use your approved reporting channel to share those details instead of sending work data to your personal email.

Should I delete all of the spam?

Ask your organization what records it needs. For now, keep the messages and find a separate route for time-sensitive work. Remove messages only when following the approved cleanup process.

If you need to find an order, invoice, or login alert, open the real service directly. Don’t assume a message is genuine because it looks different from the rest.

What if the caller says I can look up their ticket number?

Open the actual help-desk portal yourself or call the company number you already use. Ask who is assigned and confirm the task before agreeing to do anything.

An external support provider can be legitimate. Your organization should be able to verify its involvement without asking you to trust a ticket reference sent in the same chat.

The Bottom Line

An offer to fix a flooded inbox can arrive at exactly the moment you want help.

End the unsolicited call and reach the help desk through a channel you already trust.

Report the mail and the contact together. If you shared a screen or gave access, say what happened plainly so the real team can act.