New Microsoft Teams Feature Exposes Users to Phishing and Malware Risks

Microsoft is introducing a significant update to Teams that lets users start chats with anyone using just an email address, even if the recipient isn’t a Teams user. The feature, targeting releases by early November 2025 and rolling out globally by January 2026, expands connectivity across Android, desktop, iOS, Linux and Mac, but security experts warn it widens the attack surface for organisations.

Guests are invited by email and join conversations as external users under Microsoft Entra B2B Guest policies, a change designed to streamline cross‑company collaboration but potentially opening doors to phishing and malware. The most pressing risk is that attackers could craft legitimate‑looking chat invites to harvest credentials or sensitive information, and files shared within Teams may bypass traditional email security filters.

Mitigations include turning off this external chat option with PowerShell by setting the UseB2BInvitesToAddExternalUsers attribute in TeamsMessagingPolicy to false, adopting multi‑factor authentication, and conducting regular policy reviews alongside targeted user awareness training. Organisations are urged to deploy robust policies to prevent this feature from becoming a new gateway for cybercrime.