Microsoft Alerts Users as Hackers Exploit Teams Features to Spread Malware

Microsoft is urging organisations to harden Microsoft Teams as threat actors increasingly abuse its built‑in collaboration features—chat, meetings, voice/video, screen sharing and app integrations—to gain initial access, persist, move laterally and exfiltrate data. According to Microsoft’s Secure Future Initiative, defence is strengthened by tuning identity, endpoint, data/app and network controls around real‑world attack techniques observed across multiple campaigns.

Threat actors begin with reconnaissance, enumerating users, teams, channels, tenant configurations and cross‑tenant policies through Microsoft Graph and open‑source tooling.

They schedule private Teams meetings, leverage voice/video and screen‑sharing, and pair this with phone‑based vishing to increase credibility; recent campaigns mirror this playbook by spoofing IT workflows, faking automated notifications and using Teams‑like branding to push credential theft, remote access tools and loaders for ransomware operations.

Initial access commonly hinges on social engineering via Teams chat and meetings, distributing RMM tools, directing users to drive‑by download sites, or delivering payloads like DarkGate under the guise of tech support; malvertising has also been used to distribute fake Teams installers that deploy information stealers.

Actors exploit adaptive authentication flows and MFA fatigue, enroll alternate factors or steal tokens via device code phishing to hijack sessions and maintain access, while persistence may be established by abusing startup shortcuts, accessibility features, or adding guest users and credentials to Teams accounts.