Threats & Adversaries · Phishing / BEC
Fake Teams support chats can lead to ransomware Arctic Wolf Labs reports hundreds of cases in which attackers use Microsoft Teams external chats and fake IT-support identities to reach victims, gain remote access and deliver malware, sometimes followed by ransomware.
The pattern often starts with the victim’s inbox flooded by subscription emails. Soon after, a message posing as internal IT offers help, making an unsolicited external chat feel like a response to the problem the attacker just created. In 30–40% of the cases Arctic Wolf investigated, the identities used *.onmicrosoft.com tenant domains.
For organizations that accept external Teams chats, the trust placed in a plausible support identity is the exposed boundary. The tactic relies on social context and tenant identity, not a Teams software flaw, so patching Teams alone will not remove it.
3 sources · 5h ago
Timeline Sources Oct 27 Help Net Security
Hackers bury inboxes in spam then show up on Microsoft Teams posing as IT support - Help Net Security
In a recurring Microsoft Teams social engineering scheme, threat actors pose as IT staff to trick employees into granting remote access.
original Oct 27 Infosecurity Magazine
Attackers Exploit Teams External Chat to Breach Organizations in Under
Arctic Wolf warned that the function enables highly effective social engineering attacks, which lead to incidents such as ransomware
original Oct 26 The Hacker News
Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
Attackers abuse Microsoft Teams external chats and fake IT support identities to gain remote access, deploy malware, and steal data.
original Vendor digest: Microsoft
Part of the PlainSec briefing for 2026-10-27
Every edition of this story: Fake Teams support chats can lead to ransomware
More from today Threats & Adversaries · Phishing / BEC
Fake Teams support chats can lead to ransomware Arctic Wolf Labs reports hundreds of cases in which attackers use Microsoft Teams external chats and fake IT-support identities to reach victims, gain remote access and deliver malware, sometimes followed by ransomware.
The pattern often starts with the victim’s inbox flooded by subscription emails. Soon after, a message posing as internal IT offers help, making an unsolicited external chat feel like a response to the problem the attacker just created. In 30–40% of the cases Arctic Wolf investigated, the identities used *.onmicrosoft.com tenant domains.
For organizations that accept external Teams chats, the trust placed in a plausible support identity is the exposed boundary. The tactic relies on social context and tenant identity, not a Teams software flaw, so patching Teams alone will not remove it.
3 sources · 5h ago
Timeline Sources Oct 27 Help Net Security
Hackers bury inboxes in spam then show up on Microsoft Teams posing as IT support - Help Net Security
In a recurring Microsoft Teams social engineering scheme, threat actors pose as IT staff to trick employees into granting remote access.
original Oct 27 Infosecurity Magazine
Attackers Exploit Teams External Chat to Breach Organizations in Under
Arctic Wolf warned that the function enables highly effective social engineering attacks, which lead to incidents such as ransomware
original Oct 26 The Hacker News
Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
Attackers abuse Microsoft Teams external chats and fake IT support identities to gain remote access, deploy malware, and steal data.
original Vendor digest: Microsoft
Part of the PlainSec briefing for 2026-10-27
Every edition of this story: Fake Teams support chats can lead to ransomware
More from today