Microsoft Teams IT Scams and Entra Token Theft: How to Secure Windows Identity Access

Threat actors are bypassing traditional endpoint and perimeter controls by targeting user identities, trusted cloud services, and everyday collaboration tools. Rather than relying solely on custom malware or unpatched software vulnerabilities, attackers lean heavily on phishing campaigns, authentication token theft, session hijacking, and fake IT support scams delivered over platforms like Microsoft Teams. Because these intrusions ride on legitimate credentials and standard authentication workflows, they look remarkably like normal Tuesday morning office work to legacy monitoring tools.

When an adversary logs in rather than hacks in, the defender's job changes fundamentally. Here is a breakdown of how modern identity-based intrusions actually work inside Microsoft environments, the mechanics of Entra ID token abuse, and what Windows administrators need to do to lock down the real perimeter.

The Shift from Malware to "Logging In"​

In a traditional endpoint compromise, an attacker has to drop a payload, evade Windows Defender or an Endpoint Detection and Response (EDR) agent, establish command-and-control traffic, and escalate local privileges. Every single step generates noise.

Identity-based attacks sidestep that friction. As noted by the SANS Institute citing CrowdStrike data, 79% of cyber intrusions observed in 2024 were malware-free, with attackers frequently turning to legitimate remote management tools and stolen credentials to operate unimpeded. Similarly, CSO Online reported findings from ReliaQuest's Annual Cyber-Threat Report noting that attackers increasingly exploit trusted tools, identities, and user behavior rather than relying on technical exploit sophistication.

Once an attacker captures a valid account or an active authentication token, they do not need an exploit to read SharePoint documents, exfiltrate Exchange mailboxes, or pivot across cloud resources. To a security appliance that only checks whether a file is malicious or a port is blocked, an authenticated user downloading sensitive archives looks like business as usual.

Key Summary: The Identity Shift​

• The Old Playbook: Exploit software flaws, deploy malware, and fight endpoint security agents.
• The Current Playbook: Steal credentials or session tokens, impersonate trusted staff on collaboration platforms, and use legitimate Windows and cloud tools to move laterally.
• The Detection Gap: Traditional perimeter and signature-based tools struggle to flag malicious intent when the actor is using valid authentication.

Anatomy of a Microsoft Teams IT Support Scam​

While Petri highlights fake IT support scams on Microsoft Teams as a prominent intrusion method, it helps to examine how these social engineering chains play out on a Windows desktop. Microsoft's own security documentation and threat intelligence show that these are rarely single-message tricks; they are coordinated, multistage operations.

A common pattern documented by Microsoft involves combining email bombing, voice phishing (vishing), and Microsoft Teams impersonation:

1. The Inbox Flood: The attacker signs the target's corporate email address up for hundreds or thousands of legitimate newsletter subscriptions within minutes. This spam flood serves two purposes: it buries genuine security alerts (like password reset notices or MFA notifications) and creates immediate user frustration.
2. The "Helpful" Outreach: Right as the user's Outlook client is choking on junk mail, the attacker reaches out via Microsoft Teams—often using an external tenant configured to look like an internal help desk or an IT contractor—or places a voice call.
3. The Built-in Windows Hook: Posing as IT support offering to fix the email glitch, the attacker instructs the victim to launch Quick Assist, the legitimate remote-assistance utility built directly into Windows 10 and Windows 11.
4. Hands-on-Keyboard Control: Because Quick Assist is a signed, native Microsoft binary, launching it does not trigger standard antivirus alarms. Once the user enters the connection code, the attacker has interactive control of the session, allowing them to run PowerShell scripts, harvest browser sessions, or establish persistent access.

Notice what was bypassed here: email gateway malware filters (the newsletters were legitimate), MFA prompts (the user was already logged into Windows), and endpoint antivirus (Quick Assist is a trusted system tool).

How Token Theft and Session Hijacking Work in Microsoft Entra ID​

Even when organizations enforce multifactor authentication, attackers have adapted by targeting the digital artifacts generated after a user passes the MFA check: authentication tokens.

According to Microsoft Learn's technical documentation on Microsoft Entra ID tokens (updated May 2025), password-based attacks still account for over 99% of the identity attacks Microsoft observes. However, as organizations harden password policies, adversaries pivot to token theft. Citing the 2024 Microsoft Digital Defense Report, Microsoft Learn notes that token-theft detections had grown to an estimated 39,000 incidents per day, accompanied by a 146% year-over-year rise in Adversary-in-the-Middle (AiTM) phishing attacks.

In an AiTM attack, a user is tricked into visiting a proxy webpage that sits between them and the real Microsoft sign-in server. The user types their password and completes their MFA challenge (such as an authenticator app push or SMS code), and the proxy captures the resulting session cookie and tokens in transit.

To understand why stolen tokens are so dangerous—and why revoking them is not always a one-click miracle—administrators have to distinguish between the different token families in Entra ID:

As Microsoft Learn explains, sign-in session tokens (like Refresh Tokens and PRTs) are the crown jewels because their 90-day rolling lifetime restarts every time they are used, potentially granting an attacker weeks or months of persistent access if exfiltrated. Conversely, Access Tokens are short-lived (60 to 90 minutes) and cannot be revoked mid-flight unless the target application integrates Continuous Access Evaluation (CAE).

Additionally, attackers abuse legitimate authentication workflows such as OAuth device-code flows. In device-code phishing, an attacker sends a victim a legitimate Microsoft verification URL and a short alphanumeric code—often over messaging apps or email—tricking the user into entering the code on an already-authenticated browser. Once the user approves the prompt, the attacker's waiting client receives valid access and refresh tokens without ever needing to steal the user's password or intercept an MFA code.

Key Summary: Token Mechanics​

• AiTM Phishing: Proxies real login pages to steal session cookies right after the user satisfies standard MFA.
• Rolling Persistence: Refresh tokens default to a 90-day rolling window, allowing attackers to mint fresh access tokens quietly if the refresh token is stolen and unbound.
• Revocation Limits: Standard access tokens remain valid for 60 to 90 minutes unless Continuous Access Evaluation (CAE) is active.

Practical Hardening Guide for Windows and Entra ID Admins​

Reports like Petri's emphasize that organizations should adopt phishing-resistant authentication such as passkeys, expand monitoring across cloud apps, and accept the operational complexity required to secure identities. From a practical systems administration standpoint, however, deploying passkeys is only one layer of the defense. A passkey stops an AiTM proxy from stealing a login during authentication, but it will not stop an attacker who tricks a user into running Quick Assist or who steals an active token from memory via info-stealer malware.

Based on Microsoft's official Entra ID guidance and enterprise defense practices, IT teams should implement a multi-layered lockdown across four areas:

1. Deploy Phishing-Resistant MFA and Token Protection​

• Enforce FIDO2 / Passkeys or Windows Hello for Business: Unlike SMS, voice calls, or push notifications, FIDO2 security keys and Windows Hello for Business bind the authentication cryptographically to the legitimate domain and device, neutralizing AiTM proxy domains.
• Enforce Device-Bound Tokens: Where supported by your licensing and client applications, configure Entra ID Conditional Access to require Token Protection (also known as sign-in session token binding). This ensures that a stolen refresh token cannot be replayed from an attacker's machine because it requires cryptographic proof from the original device's Trusted Platform Module (TPM).
• Use Device-Based and Risk-Based Conditional Access: Require compliant or hybrid Entra-joined devices before granting access to sensitive Microsoft 365 workloads, and block or challenge sign-ins flagged with high user or sign-in risk.

2. Lock Down Legitimate Authentication Flows​

• Restrict Device-Code Flow: Unless your users routinely sign into headless devices or smartroom displays, create a Conditional Access policy that blocks the Device code flow authentication method across your tenant, excluding only specific service accounts or locations that strictly require it.
• Audit OAuth App Consents: As Microsoft Learn advises, monitor OAuth applications requesting permissions to corporate resources and enforce least-privilege consent policies so users cannot independently grant third-party apps read access to their mail or files.

3. Harden Collaboration Channels and Remote Tools​

• Restrict External Microsoft Teams Access: In the Teams Admin Center, move away from open external access defaults. Restrict external domains to an explicit allowlist of known partner organizations, or disable external unmanaged Teams accounts from initiating chats with internal staff.
• Control Quick Assist and RMM Binaries: Treat remote support utilities as high-risk administrative tools. If your help desk uses a dedicated Remote Monitoring and Management (RMM) suite, use AppLocker or Windows Defender Application Control (WDAC) to block unapproved remote tools—including QuickAssist.exe—for standard users.
• Build Correlated Detection Rules: Configure your SIEM or Microsoft Defender XDR to alert on multi-stage sequences rather than isolated events—for example, correlating a sudden spike in inbound email volume with an external Teams call, followed by the execution of Quick Assist, PowerShell, or mshta.exe.

4. Prepare for User Friction and Operational Trade-Offs​

There is no sugarcoating the administrative overhead: tightening identity controls introduces friction. Blocking external Teams chats will inevitably prompt complaints from sales or marketing teams who collaborate with outside agencies. Requiring device compliance or rolling out passkeys demands clear user onboarding, hardware lifecycle planning, and updated help desk verification procedures (so your real IT staff can prove who they are without training users to trust blind Teams messages).

Yet the alternative is far more disruptive. When identity is the primary target, relying on legacy MFA and endpoint antivirus alone leaves the front door unlocked. By pairing phishing-resistant credentials with token binding, strict Conditional Access, and tighter controls over built-in collaboration and remote support tools, administrators can make stolen trust much harder for attackers to cash in.