VULNpocalypse
HighEcosystem changeActive

Attackers abuse Microsoft Teams external chat for IT-support impersonation and malware delivery in under 15

Arctic Wolf saw over 400 incidents where attackers used external Teams chats and email bombing to get remote access and run payloads within 15 minutes.

Published
Updated
Exploitation
Yes, Arctic Wolf reported over 400 incidents in the wild, with roughly 15% progressing to successful compromise

What happened

Arctic Wolf published research on October 26, 2026 describing abuse of the Microsoft Teams external chat creation feature. It covers more than 400 incidents with highly consistent IT-support impersonation tactics (Infosecurity Magazine, Dark Reading). No CVE or software flaw is involved in the sources. This is abuse of a legitimate, default-enabled feature.

Typical attack chain, as reported:

  • The victim’s inbox is flooded with hundreds of newsletter or subscription confirmations within minutes (mail bombing). This creates urgency (Infosecurity Magazine, Dark Reading).
  • An external Teams user posing as IT support then offers to fix the problem the attacker just created.
  • The victim is persuaded to start a remote-access session. Quick Assist is the most common tool. AnyDesk, ScreenConnect, Atera, Zoho Assist, NetSupport and LogMeIn were also named by Dark Reading.
  • Payload execution is reached in under 15 minutes from when the victim engages. In some cases the user was told to run a PowerShell command and launch the downloaded file.
  • Follow-on activity described by Arctic Wolf’s Shubham Dubey, via Dark Reading: whoami/systeminfo reconnaissance, a PowerShell payload, a command-and-control beacon, lateral movement with Kerberos abuse such as Kerberoasting, and a second commercial remote access tool that gives a control channel surviving remediation of the original implant.

Attacker infrastructure and naming:

  • Attackers use newly created or acquired Microsoft 365 tenants. Between 30 and 40% of cases used default onmicrosoft.com domains, which need no verification (Infosecurity Magazine).
  • Dark Reading reports a shift toward attacker-controlled domains, especially .top, which made up approximately half of observed cases involving paid domains.
  • Tenant names use support, IT, admin, network or helpdesk words, sometimes suffixed with 365. Display names include “IT Support (Internal)” and friendly first names such as Liam. Locale-specific names such as “Supporte TI” and emojis in display names were also seen. Teams still labels these senders as external.
  • Multiple victims are often targeted in short windows (Dark Reading cites five-minute windows), which suggests automation.

Scale and attribution: Arctic Wolf’s Justin Moore told Dark Reading that roughly 15% of cases progressed into a successful compromise. Perpetrators were not identified. Moore said Black Basta-associated activity remains one of the most significant drivers of Teams chat abuse, but he could not make definitive attributions. Dark Reading notes earlier use of the mail bombing technique by Black Basta in mid-2024, with later examples in 3AM, Cactus, Chaos and GoGRPC campaigns. Moore also said recent campaigns combine Teams chat abuse with ClickFix-style social engineering.

Am I affected?

You are likely exposed if:

  • Your organization uses Microsoft Teams and external access is enabled. It is on by default, so any Teams user in another Microsoft 365 tenant can find, chat with and call your employees when both tenants allow external access (Infosecurity Magazine).
  • Quick Assist (built into Windows, no install needed) or other remote monitoring and management tools are not restricted to authorized IT staff.
  • Employees are not trained to read the External tag and the real sender domain.

Whether any specific tenant has been targeted is not confirmed by the sources. Check your own logs.

What to do now

  1. In Teams admin center, under Users and External access, select “Allow only specific external domains” and add only partner domains you actively collaborate with (Infosecurity Magazine).
  2. Block chat with unmanaged and Teams consumer accounts, and disable the option that lets unmanaged users start conversations with your users.
  3. Block federation with trial-only tenants, and enable “Allow my security team to manage blocked domains” so your security team can push blocks.
  4. Alert on the Teams ChatCreated event for first-contact one-on-one chats from external users. Arctic Wolf assesses this as the primary detection point (Dark Reading).
  5. Block or restrict Quick Assist to authorized IT roles, and block or uninstall unsanctioned RMM tools such as AnyDesk and ScreenConnect.
  6. Hunt for the post-access pattern: reconnaissance commands, PowerShell payload execution, new RMM tools, and Kerberoasting-style credential access. If you find a compromise, look for a second remote access tool, since it can survive removal of the first implant.
  7. Tell staff exactly how real IT support contacts them, how to read the External tag and sender domain, and how to use Teams end-user reporting for suspicious messages or external users.
  8. Note that Microsoft told Dark Reading it plans to introduce AI-powered phishing detection for first-contact external chats “next month”. This is a planned feature, not a confirmed fix, so keep the controls above in place.

Sources