Arctic Wolf Labs said it has seen hundreds of cases where attackers used Microsoft Teams chats from outside an organisation to pose as IT support. The aim is usually to get staff to install a remote-control tool. Quick Assist, which is built into Windows, was the one most often used. Many victims first got a flood of newsletter emails, then a Teams message offering to fix it. Arctic Wolf said 30 to 40 percent of cases used free onmicrosoft.com accounts. Customers reported that attackers ran malicious files within 15 minutes of a victim engaging.
Arctic Wolf says no Teams vulnerability is involved. The attackers use external chat, which Microsoft turns on by default. The report does not say how many organisations were hit or how many cases ended in ransomware. It says only that some led to broader compromise. Arctic Wolf also described one chain it called potentially new, where victims ran a PowerShell command that fetched a file from Azure storage. The report does not say who is behind it.
Arctic Wolf says most organisations have no need for open chat with any outside company. It advises switching to a list of trusted organisations, in line with Microsoft's guidance. It also points to the moment a chat is created as the best time for defenders to catch these attacks.