Fake IT support in Teams + AI-assisted supply chain attacks – new briefings

Two new briefings cover attacks that hide inside trusted tools. The first is a Teams chat from “IT Help Desk,” followed by a call asking for remote access. The second is an AI coding assistant recommending a malicious package.

What’s new

• Fake IT support calls in Microsoft Teams: A briefing for all employees on attackers posing as IT over Teams chats and calls to get remote access. It covers the signals employees will see and the habit that stops the attack.
• AI-assisted supply chain attacks: A briefing for developers on how a hijacked AI coding session pushed a poisoned package. It uses the Shai-Hulud worm as a real-world example.

Why it matters

Collaboration tools now account for 42% of phishing alerts, and there’s no link or sender domain to inspect. The habit that stops it: real IT doesn’t call out of nowhere asking for access. Verify through the official help desk, then report.

AI coding assistants often have the same permissions as the developer using them. In one attack, a single poisoned package led to stolen GitHub tokens and a worm spreading across about 100 internal repositories. The rule: treat AI recommendations as suggestions, not trusted instructions.

How to access it: These briefings are available in the Fable content catalog. Navigate to the Catalog in the Fable platform to find and deploy them.