Fake Teams IT support chats are being used to deliver malware and ransomware
Because the attacks exploit trust rather than software flaws, security teams need to watch endpoint and identity activity, not just scan messages.
Arctic Wolf Labs reports hundreds of incidents in which attackers abuse Microsoft Teams' external chat feature, posing as IT support staff to push victims into granting remote access. The operators typically flood the target's inbox with subscription emails first, then message the victim from newly created Microsoft 365 tenants, often using throwaway onmicrosoft.com domains and help-desk-style display names. Once inside, they use remote monitoring tools such as Quick Assist or AnyDesk to deploy additional backdoors, move laterally to domain controllers and drop ransomware, with Sophos linking some cases to Chaos ransomware. Because the method exploits trust rather than a software flaw, the researchers argue that organisations with external Teams access enabled should monitor endpoint and identity activity, not just scan messages.
Why it matters
The method works on people rather than code, so it reaches any organisation that lets outside users start chats with staff in Teams. Employees who receive an unexpected IT support message may grant remote access before anyone checks who is asking. Attackers first flood inboxes with subscription emails to create urgency, then arrive through newly created Microsoft 365 tenants. The effect is that a routine collaboration setting becomes an entry point for ransomware, and defences that only filter messages will miss it.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.