Attackers are abusing Microsoft Teams’ external-chat feature to impersonate IT support and gain initial access to corporate networks, with Arctic Wolf reporting more than 400 related incidents and payload execution in under 15 minutes after a victim engages. The activity abuses a legitimate collaboration function rather than a Teams software flaw, making user behavior and tenant configuration central to the defense. Arctic Wolf’s analysis [1] says the campaigns combine external chat, convincing help-desk personas and rapid social engineering.
The attacks commonly begin with an “email bombing” burst that floods an employee’s inbox with subscription confirmations and other messages. Shortly afterward, an external Teams account posing as “IT Support,” “Help Desk” or a similar internal service offers to resolve the supposed problem. Some accounts append “(Internal)” to their display name, although Teams still identifies the sender as external. Researchers also observed attackers using newly created Microsoft 365 tenants and attacker-controlled domains.
Once the employee responds, the conversation can move to a Teams voice call and a request to install or launch remote-access software. Quick Assist is especially useful to attackers because it is a signed Windows component, requires no separate installation and lets the user grant control by reading a six-digit code. Arctic Wolf also observed AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport and LogMeIn in the wider activity. In one investigated chain, a user ran a PowerShell command that downloaded an MSI, launched obfuscated scripts and deployed an implant that queried Active Directory for user and computer information.
There is no CVE or CVSS score for this activity because the attackers are not exploiting a confirmed vulnerability in Teams. Microsoft previously documented a closely related campaign by the financially motivated Storm-1811 group [16], which used Teams impersonation and Quick Assist before deploying tools including QakBot, Cobalt Strike and, ultimately, Black Basta ransomware. Microsoft’s more recent cross-tenant intrusion guidance [23] likewise describes remote-support access, credential theft, lateral movement and data exfiltration.
Microsoft Teams external access is designed to let users communicate with people in other organizations, but organizations can reduce the exposure without disabling collaboration outright. Microsoft recommends configuring external access to allow only specific external domains [17] and blocking communication with trial-only tenants with Set-CsTenantFederationConfiguration -ExternalAccessWithTrialTenants "Blocked". Administrators should also monitor newly created external chats, restrict Quick Assist and unsanctioned remote-management tools, and alert on unusual PowerShell or MSI activity.
For employees, an unsolicited external “help desk” message—particularly one arriving after an inbox flood—should be treated as suspicious. Microsoft advises users to verify the sender independently and use Teams’ reporting controls rather than accepting remote assistance. Out-of-band confirmation through a known telephone number or approved service desk can prevent an attacker who controls the Teams conversation from turning a routine chat into hands-on-keyboard access.
References
- Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access – Arctic Wolf
- Threat actors misusing Quick Assist in social engineering attacks …
- IT Admins – Manage external meetings and chat with people and organizations using Microsoft identities – Microsoft Teams
- Cross‑tenant helpdesk impersonation to data exfiltration – Microsoft
