- Arctic Wolf reports hundreds of cases where attackers used Microsoft Teams external chat, posing as IT support, to get remote access. It says no Teams vulnerability is involved.
- Customers reported payload execution in under 15 minutes once a victim engaged. The chat alert can arrive after the computer is already compromised.
- Arctic Wolf advises moving external access from allow-all to a list of trusted organizations, and alerting on remote-access tools nobody approved.
The door is open by design
Most security talk centres on software flaws. This attack needs none. Arctic Wolf Labs describes a repeating pattern in hundreds of cases. Attackers reached employees through the external chat feature in Microsoft Teams. Infosecurity Magazine, covering the report, puts the figure at over 400 incidents.
Arctic Wolf says Teams ships with external access switched on. The setting is also called federation. It lets a Teams user from another Microsoft 365 tenant, which is another organization's account space, find your staff, message them and call them. Both sides must allow it.
Arctic Wolf says the activity exploits no known Teams vulnerability. It uses a normal feature that is on by default.
The lesson here is that a trusted channel can be the weak point even when the software has no bug. Employees learn to distrust email. A message inside their own Teams window does not set off that caution. Arctic Wolf makes the same point: the trust is abused, not the code.
How the attack works
Arctic Wolf says customers often saw mail bombing first. That means hundreds of newsletter or subscription confirmations flooding an inbox within minutes. Moments later, a Teams message from "IT support" offers to fix the very problem the attacker just created.
The sender is easy to fake. Arctic Wolf found that 30 to 40 percent of the cases used a free default onmicrosoft.com domain. That domain needs no verification. It can be set up in minutes.
Attackers pick a name built around words like support, helpdesk or admin. The sender then looks like internal IT.
Arctic Wolf also reports a recent shift to paid domains. Of those it identified over the past few months, about 50 percent used the .top ending. Around 40 percent used a standard .com. Just over five percent used multi-level endings such as .com.pl.
The attacker's next aim is usually control of the victim's computer. The tool of choice is a genuine remote support program. Quick Assist, built into Windows, was the one Arctic Wolf saw most often.
Arctic Wolf offers a likely reason. Microsoft signs it, nothing needs installing, and the victim only reads out a six-digit code. For lasting access, attackers move to commercial tools such as AnyDesk, Atera or ScreenConnect.
Attackers generally avoid pasting a link into Teams, because that would trigger Microsoft's link scanning. Instead they steer the victim to the payload during the remote session. Message scanning alone therefore misses the key step.
Speed changes the defender's job
Arctic Wolf says attackers often contact several users within about five minutes, most likely through automation. Once a victim engages, customers reported payload execution in under 15 minutes.
In several cases, Arctic Wolf saw credential-theft detections fire alongside the first Teams alert. Kerberoasting was one of them. That points to a computer already compromised when an analyst opened the chat alert.
Picture the analyst working through a queue while the employee has already read out a code.
The technique is not new. Arctic Wolf says Microsoft documented it in the Black Basta campaign in mid-2024. Reports on Cactus, 3AM and Chaos followed.
Arctic Wolf also describes a chain it calls potentially novel. The victim was told to run a PowerShell command. That command fetched an installer from Azure Blob Storage. The installer unpacked an implant, which queried Active Directory for computer and user objects. It then sent the results to command servers.
One caveat applies. The figures come from Arctic Wolf's own customers and telemetry. They describe what one vendor saw. Infosecurity notes the researchers did not identify who is behind the attacks.
What to ask your team
Arctic Wolf says most organizations have no real need for chat open to every outside tenant. Citing Microsoft's guidance, it advises replacing "allow all" with a list of trusted organizations. Infosecurity adds the admin-center route. Select "Allow only specific external domains" and list only active partners. The report also advises blocking chat with unmanaged accounts.
Put these questions to your IT and security leads:
Is external access in Teams set to allow all, and who last reviewed it? Do we alert when a new external tenant starts a one-on-one chat? Arctic Wolf calls that ChatCreated event the main detection opportunity. Do we alert on remote-access tools nobody approved? Do employees know how to report an external message, now that Teams has a built-in reporting option?
The costly part of this attack is not an exploit. It is a default nobody chose and a message that looks like it came from down the hall.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Arctic Wolf.
