Attackers Breach Organisations Through Microsoft Teams Chats

Arctic Wolf researchers said they had observed more than 400 incidents in which attackers abused Microsoft Teams’ external chat feature to gain initial access to organisations. The attacks used consistent IT-support impersonation tactics and, after a victim engaged with the first social-engineering message, reached payload execution in under 15 minutes. Attackers often contacted several people within a short period, which the researchers said suggested automation. They did not identify those responsible, but noted that ransomware groups including Black Basta have used external Teams chat as an initial-access route.

The attackers created or acquired Microsoft 365 tenants with names suggesting support, IT, administration or helpdesk teams. In 30–40% of cases, they used default onmicrosoft[.]com domains, which the researchers said can be set up within minutes without verification. In a significant number of attacks, victims first received hundreds of newsletter or subscription confirmations; the attackers then offered IT support through Teams, appearing to address the disruption they had caused.

They commonly sought remote access using Quick Assist, built into Windows, and sometimes used commercial tools such as AnyDesk or ScreenConnect to maintain access. These tools could be used to run PowerShell payloads and move across a network; in some cases, victims were told to run a command and launch a downloaded file.

Arctic Wolf recommended restricting external Teams access to approved domains, blocking chats from unmanaged accounts and trial-only tenants, and limiting Quick Assist and unauthorised remote-management tools.