Job Scam Phishing and Teams Trojan Target Small Businesses

by The Creator | Jul 7, 2026

Phishing training is now critical for small businesses facing two coordinated attack campaigns: fake recruiter emails harvesting Gmail credentials and attackers impersonating IT support over Microsoft Teams to deploy EtherRAT malware. Employee recognition of social engineering is your first line of defense against credential theft and remote access compromise.

Today's cyber threats hit close to home for small businesses. A sophisticated phishing campaign is using fake recruiter emails from well-known brands to harvest Gmail credentials through convincing fake career pages. Separately, attackers are weaponizing Microsoft Teams by impersonating IT support staff, calling employees and tricking them into installing remote access tools that deploy the EtherRAT malware.

On the policy front, the UK government launched its Cyber Resilience Pledge with over 60 major organizations signing on, while the Bank of England issued warnings that frontier AI capabilities are making cyberattacks faster and larger in scale. Banking regulators globally are concerned about AI-driven threats.

The core lesson for small businesses: invest in employee training to recognize social engineering tactics, verify all IT support requests through separate channels, and maintain basic cyber hygiene including multi-factor authentication and regular software updates.

What phishing training tactics stop these job scam and Teams attacks?

The current threat combines two social engineering vectors targeting small business staff: fake career pages from brand impersonation harvesting credentials, and phone-based social engineering via Teams calls requesting remote access tool installation. CISA and UK Cyber Resilience Pledge signers emphasize verification protocols as the control layer. Train employees to request IT support callbacks through known phone numbers, never click links in unexpected recruiter emails, and flag Teams calls requesting tool installation. Multi-factor authentication blocks credential-only breaches. Conduct monthly phishing simulations and track which employees click or report suspicious emails. One quarterly training session per quarter is insufficient; embed micro-learning into onboarding and monthly security updates.

Key takeaways

Verify all IT support requests by calling back through company directory, not numbers in the request.
Train staff to recognize job scam emails impersonating real brands and suspect career pages with credential harvesting forms.
Enforce multi-factor authentication on email and remote access tools so stolen passwords alone cannot grant entry.
Run monthly simulated phishing campaigns and track reporting rates to identify staff needing additional coaching.

Frequently asked questions

How often should we run phishing training for a 25-person manufacturing firm?

Start with quarterly instructor-led sessions covering current attack vectors, then add monthly micro-learning modules (5-10 minutes) tied to real threats your industry faces. Monthly simulated phishing campaigns help reinforce recognition without overwhelming staff. Track which employees click or report suspicious emails to spot high-risk roles.

What should employees do if they click a fake recruiter link and enter credentials?

Report to IT immediately so passwords can be reset and MFA status verified. IT should check for unauthorized sign-ins via Gmail or Teams activity logs, enable security alerts, and force a password change on dependent accounts (email, VPN, cloud apps). If Teams was accessed, revoke active sessions and audit admin activity.

Does multi-factor authentication stop Teams impersonation attacks?

MFA prevents attackers from signing in using stolen credentials alone, but does not block phone-based social engineering where attackers call employees posing as IT staff. Both controls are needed: MFA blocks credential-based attacks while call verification and employee training block impersonation attacks.

How do we verify IT support requests if attackers have already compromised email?

Maintain a separate, offline contact list (printed or in a personal phone) of IT support phone numbers and escalation contacts. Train staff to initiate contact, never respond to unsolicited requests. For Teams calls, hang up and call your IT number directly from your phone. Never provide remote access credentials via Teams or email.