Immediate actions

• Establish and enforce a strict policy requiring employees to verify IT support identity through an official internal directory before granting any remote access.
• Restrict or disable Microsoft Quick Assist and similar remote access tools for standard users, allowing use only via approved, audited channels.
• Alert all staff to the active campaign with specific examples of what fake IT outreach looks like, including unsolicited Teams calls from unknown accounts.

Long-term improvements

• Implement a verified IT support workflow where helpdesk staff initiate sessions only through ticketing systems, never via unsolicited calls.
• Apply conditional access policies to block remote desktop tools from running unless explicitly authorized by a privileged account.
• Regularly conduct vishing simulation exercises to measure and improve employee resistance to social engineering over voice and video channels.

Detection measures

• Monitor and alert on the execution of remote access tools (Quick Assist, RemSupp) by non-IT user accounts in your SIEM or EDR platform.
• Create detection rules for suspicious persistence mechanisms disguised as Realtek or Windows audio components in unexpected registry or startup locations.
• Set up anomaly alerting for unusually rapid privilege escalation or lateral movement activity occurring within short post-login timeframes.