Tech Support Scams Are Surging … and Working
- Read time: 5 mins
The text shows up mid-afternoon. “IT here. We’re seeing unusual sign-in activity on your account. Expect a call in a few minutes.”
Then your phone rings. The caller knows your name, your manager’s name, and the software your company runs. He’s calm and helpful. He just needs you to confirm a code so he can lock things down.
Ten minutes later, he’s inside your network.
The HBS SOC team has watched this play out again and again in recent months. Tech support scams aimed at employees through texts and phone calls have become one of the most successful ways attackers get in. Scammers have run fake support calls for years, but lately—thanks in large part to AI—they’ve become more and more successful.
From Fake Pop-Ups to Fake Help Desks
The classic technical support scam mostly went after consumers. A pop-up warned of a virus or a number on the screen connects you to a “technician” who wants remote access and payment in gift cards. The FTC still sees plenty of these.
The version now hitting businesses looks more professional. Tech scammers pose as your own IT department, looking to do an MFA reset, a passkey setup, or even a security update. Contact usually starts with a text and then moves to a phone call. Sometimes the caller will ask for a verification code, and other times he will send a link to a login page built to look exactly like your company’s. We’ve even see a bad guy talk employees into installing a remote access tool “so I can fix it for you.”
In September, Help Net Security reported on research into one IT support phishing campaign that went after directors, VPs and other executives. Targets clustered in construction, engineering, healthcare, finance, real estate and professional services.
It should be noted that much of this recent IT scam activity has been attributed to the Aur0ra ransomware group.
Why the IT Support Scam Works So Well
People want to cooperate with IT. Nobody wants to be the one who ignored a security warning. When you hear a patient voice offering to fix a problem, that turns initial skepticism into trust fairly quickly. And when a little urgency is added, like “your account locks in 15 minutes,” people tend to skip steps they’d normally follow.
Executives feel this pressure more than anyone because their time is tight, while their company access is extremely broad. A tech scammer who gets one executive to cooperate can usually reach data across the whole business.
The Phone Is a Blind Spot
One of the things that concerns our SOC team the most is that these attacks start on a personal mobile device, and traditional security tools have almost no visibility there.
Email gateways scan every message but it doesn’t hear a phone call. Web filtering blocks bad links on company laptops but has no say over a text on someone’s personal iPhone. The first stage of these attacks are happening entirely outside security tools.
What Happens After the Call
From there, the attack typically takes one of two paths.
On the first, the employee installs a remote access tool or runs a command the caller reads to them. Result: the attacker now controls a trusted company device.
On the second, the employee enters a password and MFA approval into a fake login page. Result: the attacker captures the session and walks right in.
Both paths end with an attacker working inside your environment and looking like a legitimate user.
Why Identity Controls Miss It
For the last decade and a half, security architecture has leaned on a principle called identity as a perimeter. The thinking goes: users and devices live everywhere now, so the network edge no longer marks the boundary. But identity does. And if you protect the sign-in and watch for suspicious logins, then you cna protect the business.
That model has served companies well. But it also has a gap.
An attacker sitting within a user’s own device doesn’t need to steal that user’s identity. The laptop is already signed in. Traffic flows from a known machine on a known network. Firewall rules see nothing unusual. Identity alerts stay quiet because, as far as they can tell, the real user is at work.
The Endpoint Is Your First Real Chance Against IT Support Phishing
In most of these attacks, the endpoint gives defenders our first shot at spotting compromise. That makes endpoint behavioral detection one of the most important controls you have against IT support phishing.
Extended detection and response (XDR) watches what happens on devices themselves, flagging a remote access tool that appears out of nowhere. It also notices a process chain that no employee would run, and catches an account suddenly touching thousands of files. These signals give a security analyst enough reason to isolate the device before data leaves the building.
Speed is extremely crucial here. These attackers move within minutes of getting access. Telemetry only helps when someone is watching around the clock and acts fast.
How to Shrink Your ‘Support Scam’ Exposure
Awareness. Let employees know these things are happening all across the globe in every industry.
Make sure every single person knows that IT will never ask for your MFA code or password. Repeat it often … even if you get tired of saying it.
Then back it up.
- Build a callback habit. Employees hang up and call the help desk on a number they already know.
- Move to phishing-resistant MFA. Passkeys and FIDO2 keys can’t be relayed through a fake login page.
- Tighten Conditional Access. Block or challenge sign-ins from proxy and hosting networks.
- Lock down remote tools. Allow only approved remote access software and limit admin rights.
- Manage mobile devices. Some visibility where the attack starts beats none.
- Train with real scenarios. Include voice calls and texts. Train your own help desk too, since attackers impersonate them.
Culture carries as much weight as any tool. Employees need permission to hang up on “IT” and double-check. Nobody should get in trouble for asking.
Additional Tips from the HBS SOC
A quick win Microsoft Defender: many HBS clients have responded to this activity with the allow/block list in Microsoft Defender.
The strictest setup is allow-only. Only known vendors and partners can reach your users, which cuts this traffic sharply. It won’t stop everything. Attackers often take over a real vendor account and use it to contact that vendor’s partners right away.
Allow-only won’t fit every situation. The fallback is to add domains to the block list as they show up in malicious activity. It takes more upkeep but still narrows the path to your users.
Microsoft’s guidance on managing Allow/Block listing.
Microsoft’s guidance on best practices for secure Teams messaging.
When an Employee Suspects a Support Scam
Speed will always beat certainty. Employees should report right away, even when they aren’t sure. Disconnect the device from the network. Reset credentials and revoke active sessions. Then let your security team review endpoint activity for anything the caller left behind.
Put Eyes on Your Endpoints
The HBS Security Operations Center monitors endpoint telemetry 24x7x365 and responds the moment behavior looks wrong. Talk with our team about managed XDR and see how your environment would hold up against an IT support scam.
Related Content
Mobile Device Security: Phishing, Mishing, and More
Protect your business from evolving mobile threats. Learn the top mobile security risks, best practices to mitigate them, and how HBS can help.
Managed Security Awareness Training
Boost cybersecurity with Managed Security Awareness Training from HBS: Empower employees to combat phishing and enhance defense. Transform risk into strength.
SMiShing Attacks: How to Identify and Respond
Here are just a few ways to respond to attacks, including actionable steps to lower your risk and ensure personal, private information is never leaked.
