GoKawiilArctic Wolf details 400+ attacks abusing Microsoft Teams external chats
Arctic Wolf has documented a social-engineering campaign affecting more than 400 incidents in which attackers flood employees' inboxes with mail-bomb spam, then contact them via Microsoft Teams' external chat feature posing as IT support. Victims are talked into granting remote access through tools like Quick Assist or AnyDesk, after which attackers move from recon to credential theft, lateral movement and payload execution in under 15 minutes.
GoKawiil's interpretation of the reporting above, not reported fact.
The speed and repeatable pattern described by Arctic Wolf's Shubham Dubey suggests a scaled, semi-automated operation rather than isolated incidents, using shared throwaway tenants, display names and infrastructure. This could push organizations to restrict external Teams communication by default and retrain staff to treat unsolicited 'IT support' chats as a major red flag, given how quickly access can escalate to ransomware-level compromise.
- Attackers combine email bombing with fake IT-support messages on Microsoft Teams external chat to pressure victims.
- Once remote access is granted, attackers can reach payload execution in under 15 minutes using recon, PowerShell, and lateral movement.
- Arctic Wolf found over 400 incidents sharing the same throwaway tenants, display names and remote-access tools, pointing to a coordinated campaign.
YubiKey 5C NFC Security Key — With attackers impersonating IT support over Teams to trick employees into granting remote access, phishing-resistant hardware authentication is a smart defensive layer. A YubiKey enforces strong multi-factor authentication that social-engineering tricks like email bombing and fake IT chats can't easily bypass, making it a practical safeguard for employees and IT admins alike.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com — Alexander Culafi, 2026-10-27
Published there as: “External Teams Chats Anchor 15-Minute Malware Delivery”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.