Attackers Use Microsoft Teams External Chat to Impersonate IT and Deliver Malware

Overview

• Arctic Wolf, which published its report on Oct. 26, documented more than 400 incidents that follow a consistent IT‑support impersonation pattern using Teams external chat.
• The attacks often start with mail‑bombing inboxes to create urgency and then move victims into Teams where fake 'help desk' accounts prompt quick remote access.
• Threat actors set up throwaway tenants using default onmicrosoft.com domains or IT‑themed .top/.com names to look legitimate and bypass casual user suspicion.
• Once connected, attackers obtain hands‑on‑keyboard access with Quick Assist or commercial RMM tools, run PowerShell or MSI installers (sometimes hosted on Azure Blob Storage), and then move laterally to steal data or deploy ransomware.
• Arctic Wolf recommends defensive steps such as limiting external Teams domains, blocking unmanaged or trial tenants, restricting Quick Assist and unsanctioned RMMs, and training staff to verify IT contacts.