Teams Vishing Rose 502% in a Year. Here Is the Simulation That Tests It.
Teams Vishing Rose 502% in a Year. Here Is the Simulation That Tests It.
Microsoft’s 2026 Digital Defense Report puts confirmed malicious Teams vishing up 502% year over year. We checked the numbers, broke down the call, and walk through a sample Teams vishing simulation that tests the one thing that matters: whether your verification step fires.
The message came from inside Teams. The verification has to come from outside it.
What is Teams vishing?
Teams vishing is voice phishing delivered through Microsoft Teams. An adversary contacts an employee from an external tenant, usually as IT support or the help desk, opens with a chat, then moves to a Teams voice call to talk the target into a consequential action such as a remote support session, an MFA reset or a code read back.
We run this exact scenario as an authorized simulation for enterprise clients, with AI voice agents that hold a live two-way conversation. So when Microsoft published its 2026 Digital Defense Report on October 1 and a summary of it started circulating with a headline number for Teams vishing, we did what we would want any vendor to do before building an argument on a statistic. We went to the source.
The number holds. What it measures matters more than how big it is.
What the Microsoft Digital Defense Report 2026 found on Teams vishing
The report covers July 2025 to June 2026 and draws on what Microsoft describes as more than 165 trillion security signals a day. Three figures frame the Teams vishing picture, and they come from two different Microsoft publications, which is worth keeping straight.
Year-over-year rise in confirmed malicious voice phishing over cross-tenant Microsoft Teams calls.
Microsoft Digital Defense Report 2026, July 2025 to June 2026Share of the voice phishing attacks Microsoft observed that kept the target on the line long enough for social engineering to begin.
Microsoft Digital Defense Report 2026, key figuresWeekly malicious Teams call attempts by the end of June 2026, measured against the mid-2025 baseline.
Microsoft email threat landscape, Q2 2026The 502% and the roughly tenfold figure are not the same measurement. One is confirmed malicious activity year over year in the annual report. The other is weekly call attempts in a quarterly report. Both point the same direction, and neither should be added to the other. Microsoft also does not publish the absolute count behind the 502%, so it describes growth in what Microsoft’s telemetry confirmed, not a count of victims or a success rate.
That last point is not a weakness of the finding. It is the reason to test. A global growth rate tells you the channel is moving. It cannot tell you whether your help desk procedure holds when the call arrives.
We checked the summary that went viral
A community summary of the report shared widely on r/cybersecurity listed five headline findings. Here is how each one stands against Microsoft’s own published material.
Five claims from the circulating summary, checked against Microsoft’s published report page, blog and quarterly data.
| Claim in the summary | What Microsoft published | Status |
|---|---|---|
| Teams vishing up 502% YoY | Confirmed malicious voice phishing over cross-tenant Teams calls rose 502% year over year. | Verified |
| ClickFix grew 8x in four months | Reported as more than 1.1 million unique devices between February and early May 2026, roughly an eightfold rise. | Supported |
| Sessions over malware | Between 89% and 95% of email phishing attachments led to a credential theft effort. Some summaries round the top of that range to 96%. | Verified, use 89 to 95 |
| AI agents bring identity and trust problems | Agent identity, scoped credentials, least privilege and revocation are a full section of the report. | Verified |
| Patch velocity matters more | The report says the median time from vulnerability discovery to weaponization has fallen below 24 hours. | Verified |
Green: matches Microsoft’s published figures. Amber: accurate, with a rounding difference worth correcting before you quote it.
The summary’s closing takeaway also holds up: AI is accelerating the adversary, but the intrusions still run through familiar weaknesses. Microsoft’s own framing is that the underlying methods often remain familiar while speed and scale change. Teams vishing is the clearest example in the whole report. Nothing about it is technically novel. It is a help desk phone call, moved onto a channel people trust more than email.
Why Teams vishing works: the channel feels internal
Email took thirty years to harden. Secure email gateways, external sender banners, sandboxed attachments and a well-drilled report button all sit between an unexpected email and an employee. A Teams call from an external tenant passes through none of them, and it lands in the tool employees use to talk to their own colleagues.
Microsoft’s Q2 2026 data adds a detail that changes how defenders should think about the call. The share of Teams phishing attacks using a help desk persona rose from 22% in April to 31% in June 2026, and by June more than half of Teams phishing attacks used generic display names rather than any branding at all. Financial and executive impersonation, the staple of email fraud, has been largely absent from Teams.
In other words, the adversary is not investing in a perfect disguise. A plain name and a routine help desk request are enough, because the request fits a workflow the employee already trusts. That is exactly the pattern we described as synthetic normalization: plausibility beats fidelity. The call does not need to sound perfect. It only needs to make sense.
Anatomy of a Teams vishing call
Microsoft’s Detection and Response Team published a full case in March 2026 in which a compromise began with a Teams voice phishing interaction from an adversary impersonating IT support. Combined with the report data, the sequence looks like this.
Pressure first
The effective version opens with a visible, annoying problem, often a mailbox flooded with sign-up confirmations, so that help arriving a few minutes later feels like relief rather than an interruption.
A chat from outside the tenant
Contact arrives from an external Microsoft 365 tenant the adversary controls, under a display name such as IT Service Desk. The display name is a string the sender chose. Nothing about it was verified.
The Teams call
The chat escalates to a Teams voice call. This is the leg that has grown fastest, because a live conversation answers objections in real time, and Microsoft reports that most voice phishing attempts it observed kept the target on the line long enough for the social engineering to begin.
The consequential action
The ask is routine for a real help desk: open Quick Assist or another remote support tool, approve an MFA prompt, read back a code, or install a utility. Microsoft’s incident responders traced a full compromise to exactly this kind of support call.
Foothold to persistence
Once a remote session is open, the adversary typically installs an unsanctioned remote management agent and begins reconnaissance. Microsoft describes that agent as one of the most reliable mid-stage signs of a human-operated intrusion.
Stage four is the one to design around. Every stage before it is the adversary building pressure. Stage four is the moment your procedure is supposed to fire, and it is the moment a simulation should measure.
A sample Teams vishing simulation
This is the part we can show rather than describe. Our public Teams phishing simulation sample lets you experience the channel mechanics directly: a message arrives in Teams from a familiar-looking persona, escalates to a call, and a failed interaction triggers a short targeted training module on the spot. The sample uses an executive persona because it makes the channel easy to see in a few seconds.
Microsoft’s data says the persona adversaries are actually leaning on in Teams is the help desk. So that is the scenario we recommend running first, and it is the one we run as a standalone Microsoft Teams impersonation simulation against a client’s real tenant. Here is a sample run.
Every line below is simulated. The run stops at the dashed line, before any session exists.
Hi, this is the Service Desk. We can see your mailbox is being flooded with sign-up emails. We are applying a filter now.
I will give you a quick call on Teams to finish it. Two minutes.
Thanks for picking up. I just need to apply the filter on your machine. Can you open Quick Assist and read me the code?
Remote support session requested by an inbound, unverified external contact.
| Recorded outcome | What it means | Finding |
|---|---|---|
| Verified out of band | Procedure held: confirmed through the real ticket portal or the published service desk number | Holds |
| Verified inside Teams | A check ran, but on a channel the caller supplied, such as a number dropped in the chat | Defeated check |
| Skipped | The action was agreed without any verification | Exception |
| No step written | No verification requirement exists for a support request arriving over Teams | Coverage gap |
Each outcome is resolved against the client’s ticketing and call records and named against the procedure, never against the person.
The second row is why we deliberately offer the target a way to check us. If the only possible outcomes are comply or refuse, a simulation cannot see a procedure that ran and was defeated, which is one of the most common real-world failures there is. Out-of-band verification means a channel the requester did not supply. Inside Teams, every channel the employee reaches for first was supplied by the caller.
Want to see this sample run against your own tenant and your own written procedure? That is the engagement.
Book Your DemoWhy spotting the fake is not the control
The instinctive response to a 502% headline is more awareness training: teach people to recognize a suspicious Teams call. Awareness of the threat matters, and Microsoft’s own guidance is to change behavior. The question is which behavior.
Asking people to detect a fake caller by ear is a decaying control. Voice generation improves on the adversary’s schedule, and as the Q2 data shows, the adversary on Teams does not even need a convincing voice. A verification procedure does not have that problem. A callback to the published service desk number returns the same answer whether the caller is a person, a crude bot or a flawless clone. It does not evaluate the voice at all.
That is also why technical controls belong in the same plan, not in opposition to it. Narrowing external access, keeping external warnings on, allowlisting remote tools and turning on Teams protection in Defender for Office 365 all reduce how often the call reaches anyone. The procedure is what holds when one does. A good Teams vishing simulation tests both layers in one run: whether the call could reach your people, and whether the step fired when it did.
Precise about the claim. A convincing call does not break a verification step, but it does raise the pressure to wave the step through. That is why we measure how often a required check is skipped or satisfied on the wrong channel, rather than claiming any procedure is unbreakable.
What to measure after a Teams vishing simulation
Click rate does not exist in this channel. There is no link. These are the three numbers that tell a security leader whether the Teams path is covered.
Does a written step exist for Teams?
Most organizations verify outbound wires and nothing that arrives over Teams. Coverage can be assessed before a single call is placed.
Did the step fire under pressure?
Verification executed through an independent channel, over verification required. This replaces click rate as the headline.
How often was it waived or rerouted?
Checks skipped, or satisfied inside Teams on a channel the caller supplied. This is the number that moves as the calls get better.
What to do about Teams vishing this week
Every step below is free to start and works whether the next Microsoft report shows the curve flattening or doubling again.
Narrow Teams external access
Move external access from open to an allowlist of the partner domains you actually work with, and block unmanaged and consumer accounts separately. Microsoft’s own incident responders lead with this recommendation. It shrinks who can reach your people before any human judgment is involved.
Publish the help desk never-list
Tell every employee, in one sentence, what your service desk will never do: start a remote session from an unsolicited Teams chat or call, ask for an MFA approval, or ask for a code read back. A short never-list turns a judgment call into a boundary.
Bind verification to the request, not the caller
Any remote session, credential reset, MFA change or software install requested over Teams is confirmed through a channel the requester did not supply: the real ticket portal, or a call back to the published service desk number. The check fires on the request class, whoever appears to be asking.
Allow remote tools only through endpoint policy
Permit only the remote support and management tools your IT team actually uses, enforced by endpoint policy rather than user discretion. If the phone leg succeeds, this is the control that stops the session from becoming a foothold.
Simulate the voice leg, not only the message
A Teams message test tells you who reads a suspicious chat. A Teams vishing simulation tells you whether the verification step fires when a live voice is applying pressure. Test the call, and test the inbound callback.
How Breacher.ai runs Teams vishing simulations
Breacher.ai was built for the channel shift this report describes. The OSES™ engine runs authorized, fully automated, orchestrated simulations across email, voice, Teams and video, with AI voice agents that hold a live two-way conversation and handle the inbound callback. Orchestration means the second stage changes based on what the target did in the first, which is exactly how the Teams sequence above unfolds in the wild. Few platforms can run that sequence end to end.
For teams that want a single scoped test, the Teams impersonation simulation runs as a one-off engagement with no platform commitment. For ongoing programs, the simulation platform covers voice through AI vishing simulation and help desk impersonation, and the add-on for Microsoft Attack Simulation Training layers AI voice and deepfake video on top of the Teams message simulations you may already run, currently as a free beta.
Every finding is named against the procedure that failed. The Secure Behavior Management platform then generates training on that exact procedure in minutes, from your own policies and in any language, and the re-test runs against the same control so you can show it holds better than last quarter. For what these calls look like at scale, see our AI vishing field findings and the remote support simulation breakdown.
Your people are not the weak point in this story. They are being helpful on a platform built for collaboration. Give them a procedure that holds no matter who appears to be calling.
The caller keeps getting better.
The callback does not have to.
Thirty minutes. We will show you the Teams vishing sequence, the outcomes it records, and the training it generates from what it finds.
Book Your DemoFrequently asked questions
Teams vishing is voice phishing delivered through Microsoft Teams. An adversary contacts an employee from an external tenant, usually as IT support or the help desk, opens with a chat, then moves to a Teams voice call to talk the target into a consequential action such as starting a remote support session, resetting MFA or reading back a code.
Microsoft’s 2026 Digital Defense Report, covering July 2025 to June 2026, reports that confirmed malicious voice phishing over cross-tenant Microsoft Teams calls rose 502% year over year. Microsoft’s separate Q2 2026 email threat report puts weekly malicious Teams call attempts at nearly ten times the mid-2025 baseline by the end of June 2026.
Secure email gateways inspect mail. Teams chats and calls travel inside the collaboration platform, so a voice call from an external tenant never passes through the email controls most organizations spent years tuning. The message also arrives in a tool employees treat as internal, which lends it a legitimacy an unexpected email does not have.
Layer technical and procedural controls. Restrict Teams external access to an allowlist of trusted domains, block unmanaged accounts, keep external warnings on and allow remote management tools only through endpoint policy. Then bind verification to the request: any remote session, credential reset or MFA change requested over Teams is confirmed through a channel the requester did not supply, such as the real ticket portal or a known service desk number.
Microsoft’s attack simulation training includes simulating phishing messages in Teams. The Breacher.ai add-on for Microsoft Attack Simulation Training layers AI voice, deepfake video, SMS and QR on top of what you already run, so the voice leg of a Teams vishing sequence can be tested alongside the message. The add-on is currently available as a free beta.
A well-built Teams vishing simulation measures whether the verification step fires, not whether someone clicked. Breacher.ai stops each simulation at the verification boundary and records one of four outcomes: verified out of band, verified inside Teams on a channel the caller controlled, skipped, or no written step existed. Each finding is named against the procedure, never against a person.
Sources
- Microsoft Digital Defense Report 2026 (report page and key figures)
- Microsoft Security Blog: Insights from the 2026 Microsoft Digital Defense Report, October 1, 2026
- Microsoft Security Blog: Email threat landscape, Q2 2026 trends and insights, July 23, 2026
- Microsoft Security Blog: Help on the line, how a Microsoft Teams support call led to compromise, March 16, 2026
- Oceanleaf: Key takeaways from the Microsoft Digital Defense Report 2026 (community summary)
Find Out If Your Help Desk Procedure Holds on Teams
Bring the request you worry about most, a remote session, an MFA reset or a password change arriving over Teams, and we will show you how we would test it and how the re-test proves the procedure holds.
Book Your DemoLatest Posts
Table Of Contents
About the Author: Jason Thatcher
support@breacher.ai
