Hackers bury inboxes in spam then show up on Microsoft Teams posing as IT support
Threat actors are flooding employees’ inboxes with spam and then contacting them on Microsoft Teams as IT support, offering to fix the problem they created, Arctic Wolf has found.
The security company documented more than 400 incidents in which the external chat feature in Teams was abused. In many of these cases, the fake help desk message arrived minutes after the victim’s inbox had been filled with hundreds of newsletter and subscription confirmations.
“Microsoft Teams ships with external access (federation) turned on by default, meaning any Teams user in another Microsoft 365 tenant can find, chat with, and call an organization’s employees, provided both tenants allow external access. This is the feature attackers most frequently abuse. This activity does not exploit any known Teams vulnerability; it abuses a legitimate, default-on collaboration capability,” researchers explained.
Moving the conversation to Teams also helps the scammers get past people’s usual defenses. “Employees are generally trained to treat email with suspicion,” the researchers noted, but a message that shows up inside the company’s own Teams environment tends to get around that caution.
Fake names and borrowed trust
Between 30 and 40 percent of the cases involved free onmicrosoft.com tenants, which require no verification and can be set up in minutes. The threat actors gave them IT-sounding names such as “helpdeskteam365” and “itcoreportal.”
The display names follow a recognizable pattern. Scammers add “(Internal)” so the sender appears to work at the company, even though Teams labels them as external, and they use first names like “IT Service Desk (Matthew)” to look like a coworker. Some wrote in the target’s local language.
More than 100 names included emoji such as shields and wrenches, which Arctic Wolf believes may indicate that AI tools are being used to create the identities. In the latest cases, attackers put the victim company’s name or domain into their own display names.
“We also observed a recent shift toward paid top-level domains (TLDs) for tenant creation. Of the paid domains we identified in these types of scams over the past few months, approximately 50 percent of fake identities used the .top TLD, around 40 percent used a standard .com domain, and just over five percent used multi-level domains such as .com.pl, .com.vn, and .com.br,” Arctic Wolf added.
The shift matches earlier reporting by Sophos on the Chaos ransomware campaign, in which attackers moved away from throwaway onmicrosoft.com tenants and toward IT-themed .top domains that they used to host malware and control compromised machines.
Remote access in under 15 minutes
Once a target responds, the fake technician often switches to a Teams voice call and asks them to install remote access software. Quick Assist is the most common choice because it comes with Windows and the victim only has to read back a six-digit code.
Attack chain (Source: Arctic Wolf)
Commercial tools like AnyDesk and ScreenConnect also appear, often installed as a second way in that remains after the first one is removed.
“Attackers commonly target multiple users within short windows of time (approximately five minutes) to increase the likelihood of success, most likely performed through automation,” researchers wrote.
Once someone engages, it can take less than 15 minutes for malicious code to start running. In some cases, credential theft alerts went off at the same time as the alert for the first Teams chat, which means the computer was already compromised by the time anyone looked at it.
The intruders avoid posting links in Teams, where they would be scanned, and instead download malicious files themselves during the remote session.
In one case, the fake help desk worker had the employee run a PowerShell command that triggered a chain of hidden scripts. The final script installed a Python implant that collected the names and descriptions of every user and computer account in the organization’s Active Directory and sent the list to servers controlled by the attackers. Some of the intrusions ended with data theft and ransomware.
A familiar playbook
“Threat actors using external Teams chat as an initial-access vector is not new,” researchers said. Microsoft first described the technique in mid-2024 in attacks tied to the Black Basta ransomware group. It has since appeared in the Cactus, 3AM and Chaos ransomware operations.
According to the researchers, most organizations have no need to accept chats from any outside tenant, and they recommend allowing external chats only with specific partner domains. They also advise blocking unmanaged Teams accounts and trial tenants and limiting Quick Assist and other remote access software to authorized IT staff.
“Because this attack vector relies on social engineering rather than technical exploitation, people and process controls are critical to closing the gap,” Arctic Wolf concluded.
