Let’s keep this simple.
There’s a new twist in the world of cybercrime—and this time, it’s happening inside one of the most trusted platforms in your organization: Microsoft Teams.
According to a recent report from KnowBe4, hackers are exploiting Teams to impersonate IT staff and trick employees into downloading malware—specifically, a nasty piece of work called Matanbuchus 3.0. This isn’t just phishing emails or shady links. It’s real-time, face-to-face deception, delivered during a Teams call that looks and sounds legit.
What’s Going On?
In these attacks, cybercriminals pose as external IT support. They initiate Teams calls with targeted employees and convince them to launch Microsoft Quick Assist—a remote support tool many folks don’t think twice about. Then they guide the employee through running a PowerShell script disguised as something harmless, like a Notepad++ updater.
That script doesn’t just update software—it installs malware. And not just any malware. Matanbuchus is a sophisticated tool that gives hackers remote access, persistence, and a pathway to deploy even nastier stuff down the road, like ransomware.
Why You Should Be Concerned
- It Feels Familiar—That’s the Danger
Hackers are using tools your people already know and trust. Teams. Quick Assist. Remote help. It’s exactly what you’d expect during a busy day at work. - Real-Time Social Engineering
These aren’t spam bots. They’re real humans, trained to sound credible and get people to act fast. - Long-Term Access, Hidden in Plain Sight
Once installed, this malware sets up shop using scheduled tasks and advanced evasion techniques—making it tough to spot until the damage is done.
What This Means for Your Business
Whether you’re a nonprofit, a local municipality, a growing startup, or a multi-location company—this attack vector is relevant. If your team uses Microsoft Teams (and most do), you’ve got a potential blind spot that needs addressing.
Practical Steps to Protect Your People and Data
| Step | Why It Matters |
| Educate employees to question unexpected IT support calls, especially over Teams. | Most breaches start with a moment of misplaced trust. |
|
Limit or disable Microsoft Quick Assist unless it’s truly needed. |
Reduces the risk of remote-control hijacks. |
|
Use application whitelisting and endpoint protection to block unauthorized scripts. |
Stops bad actors from exploiting common entry points. |
|
Scan for suspicious scheduled tasks regularly. |
This is a key method attackers use to stick around. |
|
Review access controls and permissions across your organization. |
Keeps threats from spreading if one account is compromised. |
| Run simulated social engineering drills. | Builds muscle memory for spotting and stopping attacks in the moment. |
Final thoughts
Cybercriminals aren’t breaking down the door anymore—they’re knocking politely and asking to be let in. And the scariest part? Sometimes we hand them the keys because they look like someone we trust.
This isn’t about fear—it’s about awareness. The stronger your people are at recognizing threats, the harder it is for these attacks to succeed.
You don’t need to become a cybersecurity expert overnight. But you do need a plan—and a partner who can help you stay ahead of the curve.
