Cybercriminals are using Microsoft Teams to impersonate IT support staff and gain access to corporate networks, according to new research from Arctic Wolf Labs.
An analysis of more than 400 incidents found attackers exploiting the platform’s external chat feature to contact employees, often posing as internal help desk personnel. The activity relies on legitimate Teams functionality, with no software vulnerability required.
In several cases, attackers progressed from initial contact to malicious payload execution in under 15 minutes.
The campaigns frequently involved flooding employee inboxes with unwanted emails before initiating a Teams conversation offering technical assistance. Victims were then encouraged to launch remote-access software, allowing attackers to control their devices and potentially deploy additional malware.
Why It Matters: The findings document how attackers are using enterprise collaboration tools as an entry point into corporate systems. Microsoft Teams‘ external access feature is enabled by default, allowing users from other Microsoft 365 organizations to initiate conversations when permitted by tenant settings. The research also identifies opportunities to detect suspicious contacts before employees respond.
- More Than 400 Incidents Involved Teams-Based Impersonation: Attackers used external Microsoft 365 accounts with display names such as “IT Support (Internal)” and “HelpDesk Manager” to pose as corporate support personnel. Approximately 30% to 40% of the analyzed cases involved default “
onmicrosoft.com” tenant domains, which can be created without domain verification. Some attackers also incorporated company names into their display identities to make unsolicited messages appear authentic.
- Some Attacks Reached Payload Execution in Under 15 Minutes: Investigators observed attackers using email bombing to overwhelm employees with subscription messages before contacting them through Teams. The impersonators then offered to resolve the apparent problem, often through a voice call. Microsoft Quick Assist was the most frequently observed remote-access tool, allowing attackers to establish control after employees shared a session code.
- Attackers Are Adopting Custom Domains and Additional Remote-Access Tools: The research identified a move toward attacker-controlled domains, with “.top” accounting for approximately half of the observed paid-domain cases. Some domains redirected visitors to legitimate Microsoft or corporate websites. Alongside Quick Assist, attackers used tools such as AnyDesk and ScreenConnect, sometimes installing a second remote-access application to maintain access.
- One Investigated Attack Deployed Malware That Collected Active Directory Information: In the documented case, an attacker posing as IT support instructed an employee to execute a PowerShell command. The command downloaded an MSI package from Azure Blob Storage, which eventually launched a Python-based implant. The malware queried Active Directory for user and computer information and transmitted the results to attacker-controlled servers.
- New External Chat Events Provide an Early Detection Opportunity: The research identified Microsoft Teams’ ChatCreated event as a useful point for detecting suspicious contact before a recipient engages. Recommended defenses include restricting external communication to approved domains, blocking trial-only tenants, and limiting unauthorized remote-access software. The report also recommends verifying unexpected IT support requests through a separate trusted channel.
