Summary
- Arctic Wolf documented over 400 incidents involving Microsoft Teams external chat abuse.
- Attackers often flood inboxes with unwanted messages before presenting themselves as internal IT support.
- The technique exploits legitimate collaboration features rather than a newly disclosed Teams software flaw.
Cybersecurity company Arctic Wolf has analysed more than 400 incidents in which attackers used Microsoft Teams external chat to impersonate technical support staff or deliver malicious material. The research, published on 26 October, describes a repeated approach that relies on legitimate collaboration features rather than exploitation of a new Teams vulnerability.
In many observed cases, a target first receives a large volume of unexpected subscription or newsletter emails. Soon afterwards, a person appearing to represent an internal help desk contacts the employee through Teams and offers to resolve the disruption. The attacker’s opportunity comes from creating an inconvenience and then offering an apparently credible route to repair it.
The researchers observed reused display names, including variations on internal IT support labels, as well as recurring remote-access tools and infrastructure. Microsoft 365 tenants created for short-term use featured in the activity, although the report also identifies increasing use of attacker-controlled domains.
Collaboration beyond the organisation
Teams supports external access, sometimes called federation, so that users in different Microsoft 365 organisations can find one another and communicate where both sides permit it. That capability is valuable for legitimate suppliers, customers and professional contacts, but it also creates a channel in which an unfamiliar party can attempt to look like an internal colleague.
A display name that includes terms such as IT Support or Internal is not proof of organisational identity. Although Teams provides indications that a contact is external, the researchers found that attackers constructed names and pretexts intended to reduce the recipient’s attention to those signals.
Email bombing supplies a plausible explanation for the unsolicited approach. Hundreds of unwanted messages can make a support intervention appear timely, while the employee may already be distracted by the abnormal behaviour of their inbox. This sequence differs from a classic phishing email that asks the recipient to click a malicious link directly: the initial flood creates the condition in which a later conversation seems helpful.
The interaction can progress to requests for screen sharing or remote support tools. Once a user permits such access, an attacker may gain visibility of business applications, influence user actions or seek credentials. Those are possible outcomes of the method; the published research does not establish that every one of the 400-plus incidents resulted in successful compromise or ransomware deployment.
The limits of message-based identity
The findings illustrate a distinction between authenticated access to a communication platform and verified employment by the organisation being contacted. An external Microsoft account can be legitimate and authenticated by its home tenant while having no authorised relationship with the target’s internal support function.
Organisations that permit external collaboration must therefore balance operational access with how staff recognise real support channels. Blocking every external contact could disrupt ordinary work, while relying solely on display names leaves users exposed to impersonation. The appropriate controls depend on supplier relationships, federation settings and the ability to monitor suspicious external-chat creation.
Arctic Wolf says activity could be detected at the stage when the chat is created, before a targeted employee engages with the impersonator. This observation places the earliest visible signal at the communications boundary rather than after remote-control software has been installed.
The company also found infrastructure shifts from disposable Microsoft-hosted domains towards attacker-controlled web domains. That evolution could affect how detection rules generalise across campaigns, since a defence based on one naming convention might miss later variations.
Its report provides an evidence base for analysing the technique across many cases, but not a census of all Teams impersonation attempts worldwide. The dataset reflects incidents Arctic Wolf could observe and analyse, and its frequencies cannot be assumed to represent every Microsoft 365 tenant.
Arctic Wolf says suspicious Teams external-chat creation can be observed before an employee engages with a fraudulent help desk. Its 400-plus incidents concern abuse of legitimate federation functionality, rather than an exploited Teams software vulnerability, and do not establish that each targeted organisation was compromised.
