Cybercriminals Are Impersonating Law Firm IT Helpdesks

A caller says they’re from your law firm’s IT helpdesk. They say your Microsoft 365 access will stop working unless you sign in again. The link arrives while you’re still on the phone. End the call and contact IT through the number or portal your firm already uses. If the request is genuine, your team can confirm it.

What has been reported?

On 28 October 2026, the Canadian Centre for Cyber Security reported an ongoing voice phishing campaign. It had increasingly targeted finance and legal organisations since July, with October activity concentrated on the legal sector. Separately, Mandiant documented a US campaign targeting law firms and other organisations from January through May 2026. These reports describe specific campaigns in Canada and the US.

What might the caller ask you to do?

They may claim that a password change, MFA enrolment or passkey update is overdue. The call can come through Teams, an office line or a personal mobile. The number can be spoofed, and the caller may know the name of someone in IT.

The Canadian campaign used fake sign-in pages that relay credentials and authentication responses in real time. In separate intrusions, Microsoft documented fake helpdesk calls that persuaded employees to grant access through legitimate tools such as Quick Assist. Treat an unexpected request to share a connection code or approve screen control as something to verify independently.

What should staff do during the call?

What if you already signed in or gave someone control?

Report it immediately to your real helpdesk or incident lead. If the person still has control, end the session if you can and use another trusted device to report it. Say exactly what you did and when. Clicking a link, entering a password, approving MFA and granting device control each give IT different information to work with.

Preserve the call and message details. Tell the incident lead if client email, shared documents or matter systems were open. The response team can use those facts to decide what to contain, which logs to preserve and what access to investigate.

How can a law firm make this easier to report?

Put the genuine support number or portal where lawyers, reception staff and assistants can find it quickly. Agree how your provider will initiate support and who receives urgent reports outside office hours. Test the process by asking someone to find the helpdesk and report a simulated call without using any details supplied by the caller.

If your firm uses an external provider, include this exercise in your next support review. Discuss how staff verify an unexpected call and who takes ownership of a report. Learn more about IT support for law firms and legal teams.