Spam floods precede fake IT-support chats in Microsoft Teams
Original title: Hackers bury inboxes in spam then show up on Microsoft Teams posing as IT support
Arctic Wolf documented more than 400 cases; remote-access tools can be installed in under 15 minutes, sometimes leading to ransomware.
Arctic Wolf says attackers flood inboxes with newsletter spam, then message employees in Microsoft Teams as IT support minutes later. External Teams chat is on by default and is not a software vulnerability. Fake technicians move to voice calls and push Quick Assist, AnyDesk, or ScreenConnect; one case ran PowerShell that installed a Python implant enumerating Active Directory. Some intrusions ended in data theft and ransomware. Microsoft first described the method in mid-2024 with Black Basta; it later appeared with Cactus, 3AM, and Chaos.
Unconfirmed: Arctic Wolf only believes emoji-heavy display names may indicate AI-generated identities.
- Between 30 and 40 percent of cases used free onmicrosoft.com tenants.
- About half of recent paid fake domains used the .top TLD.
- Attackers often contact several users within about five minutes.
- Links are avoided in Teams; malware is downloaded during the remote session.
Impact: Remote access, credential theft, data theft, and ransomware
- 1.Allow external Teams chats only with specific partner domains.
- 2.Block unmanaged Teams accounts and trial tenants.
- 3.Limit Quick Assist and other remote-access tools to authorized IT staff.
- Vendors
- Microsoft
- Threat actors
- Black BastaCactus3AM
- Malware
- Chaos
- Organizations
- Arctic Wolf
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | onmicrosoft.com | ware campaign, in which attackers moved away from throwaway onmicrosoft.com tenants and toward IT-themed .top domains that they used to |
From the original article
3 min read at helpnetsecurity.com
Threat actors are flooding employees’ inboxes with spam and then contacting them on Microsoft Teams as IT support, offering to fix the problem they created, Arctic Wolf has found. The security company documented more than 400 incidents in which the external chat feature in Teams was abused.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.