Teams Phishing Impersonating IT Helpdesk Delivers Azure Blob MSI

Emiliano Mema@Nosalva

•updated Aug 28, 2026•2•0•12

Detects Microsoft Teams messages sent from an onmicrosoft.com domain that impersonate an 'IT Service Desk' and contain a link to an .msi file hosted on Azure Blob Storage, a common indicator of a phishing lure distributing malicious installers.