Beyond Email: Why Your Microsoft Teams Chat Is Now a Phishing Danger Zone

Security researchers at Hunters have published a new analysis showing attackers are increasingly abusing Microsoft Teams as an entry point for phishing, vishing, and malware delivery campaigns by exploiting external collaboration features. The report notes a spike in such activity over the past year, with VEILDrive, a campaign disclosed in November 2024 that targeted a U.S. critical infrastructure company, as an early example of Teams abuse for initial access.

Key techniques include one-on-one chat phishing, where attackers bypass external sender warnings by exploiting urgency or impersonation, and voice call phishing (vishing) made possible by Teams’ default voice chat, which “can, by default, call an organizational user without first sending a message… and no warning pop-up appears on the victim’s side.” Also highlighted are screen

sharing and remote control when enabled, malware delivery via SharePoint links, and meetings used to bypass warning banners, allowing a threat actor to lure users into “legitimate” meeting chats with fewer red flags. The analysis stresses that audit logs offer limited visibility for these events, urging defenders to monitor for ChatCreated and MessageSent artifacts as well as suspicious domains such as onmicrosoft[.]com.