Attackers Use Teams Chats to Deliver Malware in 15 Minutes

Arctic Wolf says attackers are abusing Microsoft Teams’ external-chat feature in a campaign recorded across more than 400 incidents. The attackers flood a target’s inbox with subscriptions or newsletters, then contact them through Teams while posing as internal IT support and offering to fix the problem. They persuade victims to grant remote access using legitimate tools, most often Quick Assist, but also AnyDesk, ScreenConnect, Atera, Zoho Assist, NetSupport and LogMeIn. Arctic Wolf says the attack can reach payload execution in under 15 minutes, with multiple users targeted within five-minute windows.

After access is granted, attackers may run malware, steal credentials, conduct reconnaissance or attempt ransomware deployment. Arctic Wolf describes a common sequence involving system reconnaissance, a PowerShell payload, a command-and-control beacon, and attempts to move laterally and obtain credentials through Kerberos abuse. About 15% of cases progressed beyond the initial stage to a successful compromise, according to Arctic Wolf’s director of adversary operations, Justin Moore. He could not definitively attribute the recent activity, but said Black Basta-associated activity remains a significant driver of Teams chat abuse.

Arctic Wolf identifies recurring throwaway tenants, “IT Support (Internal)” display names and shared infrastructure. Attackers are increasingly using their own domains, particularly .top domains, which accounted for about half of observed cases involving paid domains. The vendor recommends alerting on Teams’ ChatCreated event, restricting external chats and federation, and training staff to recognise external senders.

Microsoft said administrators can block external Teams users and that AI-powered phishing detection was due to arrive the following month, targeting higher-risk conversations such as first-contact chats.