Threats · 4h ago
Arctic Wolf Labs reports hundreds of cases in which attackers use Microsoft Teams external chats and fake IT-support identities to reach victims, gain remote access and deliver malware, sometimes followed by ransomware.
The pattern often starts with the victim’s inbox flooded by subscription emails. Soon after, a message posing as internal IT offers help, making an unsolicited external chat feel like a response to the problem the attacker just created. In 30–40% of the cases Arctic Wolf investigated, the identities used *.onmicrosoft.com tenant domains.
For organizations that accept external Teams chats, the trust placed in a plausible support identity is the exposed boundary. The tactic relies on social context and tenant identity, not a Teams software flaw, so patching Teams alone will not remove it.
3 sources covering this story
In a recurring Microsoft Teams social engineering scheme, threat actors pose as IT staff to trick employees into granting remote access.
Attackers Exploit Teams External Chat to Breach Organizations in Under
Arctic Wolf warned that the function enables highly effective social engineering attacks, which lead to incidents such as ransomware
Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
Attackers abuse Microsoft Teams external chats and fake IT support identities to gain remote access, deploy malware, and steal data.
Part of the PlainSec briefing for 2026-10-27