Attackers pose as internal IT help desks in Teams external chat
Often a flood of junk email comes first, then a Teams call from fake internal IT. Arctic Wolf says payloads can run within 15 minutes of the user engaging
- Attackers often hit several users within about five minutes, most likely through automation
- Display names often carry an “(Internal)” label to offset the External tag Teams shows
- Of the paid domains seen, about half used .top
- Arctic Wolf says its alerts fire most often when the chat is created, before the user acts
Any Microsoft 365 tenant still running Teams with open external access is in range, along with those that accept chat from unmanaged consumer accounts or trial tenants and leave Quick Assist available to all staff. Arctic Wolf says the activity exploits no known Teams vulnerability, so there is no patch to apply. It recommends an allow-list of partner domains, blocking federation with trial-only tenants and restricting Quick Assist to authorized IT roles. Microsoft has added in-app reporting so employees can flag a suspicious external user.
“This reflects an abuse of trust: employees are generally trained to treat email with suspicion, but a message delivered from inside their Teams instance bypasses that learned caution.”Shubham Dubey, staff threat researcher, Arctic Wolf Labs
Arctic Wolf has analyzed more than 400 incidents in which attackers used Microsoft Teams’ external chat to reach employees while posing as internal IT support, according to research published by Arctic Wolf Labs on 26 October. Arctic Wolf, which sells managed detection and response (MDR) services, drew the cases from its own telemetry.
External access, the Teams setting that lets users in other Microsoft 365 tenants find, message and call an organization’s staff, is switched on by default. Between 30% and 40% of the cases involved default onmicrosoft.com tenant domains, which need no verification and can be set up in minutes. Tenant names were built from words such as support, admin and helpdesk, sometimes with “365” added.
The Teams contact often follows mail bombing, in which the target’s inbox fills with hundreds of newsletter and subscription confirmations. A chat or voice call from a name such as “IT Service Desk – Liam” then offers to fix the problem and asks the user to open a remote monitoring and management (RMM) tool. Quick Assist, which is built into Windows and needs no installation, is the most common choice. AnyDesk, ScreenConnect and other commercial tools are added later to keep access.
The method predates this research. Microsoft first documented it in a Black Basta campaign in mid-2024, and it has since appeared in Cactus, 3AM and Chaos ransomware activity. Arctic Wolf does not tie the incidents it analyzed to a named group.
Sources
- Arctic Wolf, “Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access”, research blog by Shubham Dubey, 26 October 2026. https://arcticwolf.com/resources/blog/threat-actors-abuse-microsoft-teams-external-chat-for-initial-access/
- Infosecurity Magazine, “Attackers Exploit Teams External Chat to Breach Organizations in Under 15 Minutes”, James Coker, 27 October 2026. https://www.infosecurity-magazine.com/news/exploit-teams-chat-breach/
