Security Alert: Threat Actors Weaponizing Microsoft Teams External Chat for Initial Access

A significant surge in cyber-attacks targeting corporate environments has been identified, with researchers at Arctic Wolf uncovering a sophisticated campaign that exploits the external chat functionality within Microsoft Teams. By manipulating the trust inherent in enterprise communication platforms, threat actors are successfully infiltrating organizations, using the platform as a bridgehead to launch broader, more destructive campaigns, including ransomware deployment.

According to new research published by Arctic Wolf, threat actors are increasingly abusing the default settings of Microsoft Teams to initiate contact with unsuspecting employees. The findings highlight over 400 distinct incidents where this specific function was leveraged to establish initial access. These attacks are characterized by a highly consistent methodology, focusing on impersonation tactics that mimic internal IT support services to deceive users into granting remote access to their systems.

The speed at which these operations unfold is a primary concern for security teams. The entire attack chain—from the moment a victim engages with the malicious message to the execution of a harmful payload—can occur in less than 15 minutes. This rapid progression suggests that attackers are utilizing a high degree of automation to identify, contact, and compromise targets in quick succession. By cycling through multiple victims within short windows of time, the threat actors maximize their chances of success while minimizing the time security operations centers (SOCs) have to detect and neutralize the threat.

The researchers at Arctic Wolf have characterized these operations as multi-layered, often combining traditional social engineering with technical subversion. The process typically begins with an email bombing campaign, where the target’s inbox is flooded with hundreds of automated newsletter or subscription confirmations. This serves as a diversionary tactic, creating a sense of urgency or confusion for the victim. Moments later, the threat actor initiates a conversation via Microsoft Teams, posing as a member of the organization’s internal IT or helpdesk department. They offer to "resolve" the very issue they created by flooding the user’s email, establishing a false sense of rapport and legitimacy.

While the perpetrators behind this specific wave of attacks have not been explicitly identified, the tactics bear a striking resemblance to strategies employed by known ransomware syndicates, including the Black Basta group. The use of Teams as an initial access vector represents a notable shift in the landscape of social engineering, moving away from public-facing email phishing and toward the exploitation of trusted internal communication channels.

The Mechanics of Legitimate-Looking Identities

The effectiveness of this campaign relies heavily on the architecture of Microsoft Teams, which is designed for seamless collaboration. By default, external access in Teams is enabled, allowing any user from an external Microsoft 365 tenant to search for, message, and call employees of another organization, provided both parties belong to tenants that allow external communication. Threat actors are exploiting this feature by establishing their own Microsoft 365 tenants, which are effectively used as "launchpads" for their social engineering efforts.

These malicious actors often create or acquire these tenants with ease. Arctic Wolf’s analysis revealed that approximately 30% to 40% of the observed cases involved default "onmicrosoft.com" domain names. Because these domains do not require rigorous verification and can be provisioned in a matter of minutes, they provide a low-friction entry point for attackers to begin their operations. To further the illusion of legitimacy, attackers meticulously craft their display names. Common tactics include using terms like "IT Support," "Service Desk," "Network Admin," or "Helpdesk," often suffixed with "365" to sound more corporate. In some instances, attackers have even incorporated the names of the target company into their own tenant identity to gain additional credibility.

By adopting names like "IT Service Desk – Liam," attackers capitalize on the psychological tendency of employees to trust individuals who appear to represent an internal authority figure. Once the victim accepts the chat request, the social engineering phase moves into high gear. The attacker’s primary objective in most of these interactions is to gain hands-on-keyboard access to the victim’s machine.

To achieve this, they often direct the user toward legitimate remote monitoring and management (RMM) tools. A favorite choice for these actors is the Windows-native "Quick Assist" tool, as it is already installed on the operating system and does not trigger the typical security warnings associated with downloading third-party software. By guiding the user through the process of launching Quick Assist and providing a security code, the attacker gains full control of the victim’s session. Once this initial foothold is established, the attackers may pivot to more robust, third-party RMM solutions such as AnyDesk or ScreenConnect, which allow for better persistence and easier navigation of the network.

The Path to Broader Compromise

The transition from a simple Teams chat to a full-scale network compromise is swift. Once remote access is established, the attackers often instruct the user to execute specific PowerShell commands or run a file they have provided. These actions are designed to bypass standard security controls and execute the malicious payload. This execution often marks the end of the social engineering phase and the beginning of the post-exploitation phase, where the goal shifts toward lateral movement and data exfiltration.

The ability to move laterally across an organization’s network is what elevates these incidents from isolated support issues to severe security breaches. With persistence established via RMM tools, threat actors can map the internal network, identify sensitive data repositories, and, in the most severe cases, deploy ransomware. The research underscores that the "seemingly routine" chat is merely a facade for a much larger and more dangerous operation.

The reliance on built-in, legitimate tools is a hallmark of this campaign. Because these tools are essential for standard business operations, they are often overlooked by traditional security software. When an employee is the one initiating the remote access connection, it can be difficult for security monitoring tools to distinguish between a legitimate support session and a malicious takeover. This "living off the land" approach makes these attacks particularly challenging for organizations that rely solely on signature-based detection.

Mitigating the Risk of External Exploitation

Defending against this style of attack requires a combination of technical controls and a shift in organizational culture. Because the attack exploits a default configuration feature, the most effective technical mitigation is to restrict external access settings in the Microsoft 365 admin center. Organizations are encouraged to audit their external access policies to ensure that they are only communicating with trusted domains. If the business requirement for open communication is low, limiting access to specifically approved external domains can significantly reduce the attack surface.

Beyond configuration changes, the human element remains the most critical point of failure. Security awareness training must emphasize that internal IT departments will never initiate contact via an external chat link to request remote access to a machine, nor will they ask users to execute PowerShell commands or install software on a whim. The "email bombing" tactic serves as a vital warning sign; employees should be trained to recognize that if they are suddenly flooded with emails, it is likely a deliberate distraction tactic rather than a technical glitch.

Arctic Wolf’s findings serve as a stark reminder that as organizations secure their perimeters, attackers will continue to evolve, moving toward the "softer" targets within the internal ecosystem. The abuse of Microsoft Teams is not a flaw in the software itself, but rather an exploitation of the trust that defines modern, collaborative work environments. By understanding the methodology behind these impersonation attacks, security teams can better posture their defenses, implement stricter access controls, and foster a more vigilant workforce, ultimately making it significantly harder for threat actors to turn a simple chat message into a devastating network breach.