Overview
- Arctic Wolf Labs analysed more than 400 incidents and published its findings on Oct. 26, 2026, documenting a repeating social‑engineering pattern that uses Teams’ default external chat feature for initial access.
- Attackers first flood a victim’s inbox with subscription spam to create urgency and then send convincing Teams messages from newly created Microsoft 365 tenants that use IT‑themed names or the onmicrosoft[.]com fallback domain.
- Once a user engages, the campaign moves to voice calls and Quick Assist to get a six‑digit code, with adversaries often installing commercial RMMs such as AnyDesk or ScreenConnect for persistence and further control.
- Analysed intrusions show the attackers avoid links, use PowerShell to fetch MSI installers (hosted on cloud storage), run embedded Python implants that query Active Directory for user and computer lists, and in some cases exfiltrate data or deploy Chaos ransomware.
- Arctic Wolf and other researchers urge administrators to restrict external Teams chats to trusted domains, block unmanaged or trial tenants, limit Quick Assist and unsanctioned RMM tools, and train staff to verify IT contact methods to stop rapid hands‑on‑keyboard breaches.