Arctic Wolf · Published 26 Oct
Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access
By Shubham Dubey
Excerpt
Summary
Arctic Wolf Labs has observed a recurring social engineering pattern in hundreds of cases where threat actors have used Microsoft Teams’ external chat creation feature for impersonation scams, or to deliver malicious files. A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same “IT Support (Internal)” display names, the same remote-access tools, and increasingly, the same payload domains.
In this report, we’ll explore our findings,…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Arctic Wolf on arcticwolf.com.
Mentioned in the excerpt1
More from Arctic Wolf2
Arctic Wolf · Web page · Published 2 Jun
From Token Bingo to MAX Takeover: Kali365 Operator Expands Operation Across Microsoft Outlook, Okta, Xerox DocuShare, and Other Services
In our previous post, Token Bingo: Don’t Let Your Code Be the Winner, we documented Kali365, a phishing-as-a-service (PhaaS) kit abusing Microsoft’s OAuth 2.0 device authorization flow to steal Entra ID tokens. In this follow-up report, we track the same…
Arctic Wolf · Web page · Published 24 Apr
Token Bingo: Don’t Let Your Code be the Winner
In early April 2026, Arctic Wolf began tracking a large-scale device code phishing campaign impacting organizations across multiple regions and sectors. Similar to the widespread “Riding the Rails” campaign first observed in late March by Huntress, the threat…