Skip to content
NewA calmer, faster ZeroHour
StoryPhishing & fraudhigh

Attackers Use Microsoft Teams External Chat to Impersonate IT Support

8 sources · 10 articlesFirst reported Updated ()1
What's new

October 30: Microsoft disclosed two intrusions using Teams impersonation followed by ESC1/ESC8 certificate abuse, DCSync and Rclone exfiltration; October 30: Talos reported Quick Assist session leading to VYPR ransomware.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Arctic Wolf reports over 400 incidents of attackers impersonating IT support via Microsoft Teams external chat after email bombing, gaining remote access with Quick Assist and deploying malware, with some ransomware.

Arctic Wolf Labs identified over 400 incidents where attackers flood employee inboxes with newsletter spam then contact victims through Microsoft Teams external chat, enabled by default, to impersonate IT support. They persuade users to grant remote access using tools like Quick Assist, AnyDesk, ScreenConnect, TeamViewer and Atera. This enables PowerShell execution, Azure Blob Storage MSI downloads, Python implants, lateral movement, and in some cases Chaos ransomware deployment. Microsoft disclosed two separate intrusions that began with the same tactic and progressed to Active Directory Certificate Services abuse and DCSync.

Key facts
  • Arctic Wolf analyzed over 400 incidents of Teams impersonation
  • Common tools include Quick Assist, AnyDesk, ScreenConnect, TeamViewer and Atera
  • Attackers use throwaway onmicrosoft.com domains or paid domains with .top TLD
  • Payloads involve PowerShell fetching MSI from Azure Blob Storage
  • Some intrusions end in Chaos ransomware deployment
  • Microsoft disclosed two intrusions progressing to AD CS abuse and DCSync
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 26, 2026Arctic Wolf reports over 400 incidents of Teams impersonation after email bombing · The Hacker News
  2. Oct 27, 2026Multiple outlets cover Arctic Wolf report on Teams external chat malware cases · Cyber Security News
  3. Oct 27, 2026Dark Reading describes repeatable social-engineering pattern with Quick Assist · Dark Reading
  4. Oct 28, 2026Canadian Centre warns on separate voice phishing campaign · Canadian Centre for Cyber Security
  5. Oct 30, 2026Microsoft discloses two intrusions beginning with Teams impersonation · Microsoft Security Blog
  6. Oct 30, 2026Talos reports help desk impersonation leading to VYPR ransomware · Help Net Security
  7. Oct 31, 2026GBHackers reports on Microsoft disclosures of AD CS abuse after Teams tactic · GBHackers

What each outlet adds

beyond the shared facts
  • The Hacker NewsTenant domain statistics and .top TLD usage
  • Dark ReadingFollow-on Kerberoasting and GoldenPAC activity
  • Microsoft Security BlogTechnical details on ESC1 and ESC8 templates plus DCSync exfiltration
  • Help Net SecurityVYPR ransomware case and macOS trojan details
Vendors
MicrosoftCisco
Products
Microsoft TeamsQuick AssistAnyDeskScreenConnectTeamViewerAteraActive Directory Certificate ServicesMicrosoft 365SharePointOneDriveMicrosoft Quick AssistGitHub Copilot CLI
Threat actors
Black BastaStorm-1811STAC4749Cactus3AM
Malware
Black BastaChaosPetitPotamRcloneGoGRPCVYPRConti
Organizations
Arctic WolfSophosArctic Wolf LabsCanadian Centre for Cyber SecurityCisco Talos
Countries
Canada
AI models
Claude Code

Coverage

oldest first · one row per article · UTC
  1. · 6d ago The Hacker NewsFirst report

    Teams IT-support impersonation used to deploy malware and ransomware

    Arctic Wolf ties hundreds of cases to throwaway Microsoft 365 tenants, mail bombing, RMM tools, and sometimes Chaos ransomware.

  2. · 5d ago Cyber Security News

    Attackers impersonate IT support on Microsoft Teams to gain remote access

    An October 26 Arctic Wolf report on more than 400 incidents also describes a PowerShell and MSI infection chain.

  3. · 5d ago GBHackers

    Fake Microsoft Teams IT support used for remote access and malware

    Arctic Wolf tied more than 400 cases to external chats, inbox floods, and tools such as Quick Assist, sometimes within 15 minutes.

  4. · 5d ago Infosecurity Magazine

    Attackers abuse Teams external chat to breach organizations quickly

    Arctic Wolf saw more than 400 cases, often with email bombing and Quick Assist, and did not name the operators.

  5. · 5d ago Help Net Security

    Spam floods precede fake IT-support chats in Microsoft Teams

    Arctic Wolf documented more than 400 cases; remote-access tools can be installed in under 15 minutes, sometimes leading to ransomware.

  6. · 4d ago Dark Reading

    Email bombing and external Teams chats used for remote access

    Arctic Wolf reports the pattern in more than 400 incidents, with Quick Assist most often used before credential theft.

  7. · 4d ago Canadian Centre for Cyber Security

    Canadian help-desk vishing campaign bypasses MFA in real time

    Callers send staff to branded relay pages, then register MFA methods and steal Microsoft 365 data before extortion.

  8. · 2d ago Help Net Security

    Fake IT help desk calls led to remote access and VYPR ransomware

    Cisco Talos says callers often knew only names and emails, and one Quick Assist session ended in ransomware.

  9. · 2d ago Microsoft Security Blog

    Teams help-desk lures led to AD CS ESC1 and ESC8 abuse

    Two unattributed intrusions used Quick Assist; one reached DCSync and exfiltration after a privileged identity was excluded from containment.

  10. · 1d ago GBHackers

    Fake Teams IT help desk sessions abused AD CS for domain access

    Two Microsoft-disclosed intrusions used Quick Assist plus ESC1 or ESC8, then DCSync and Rclone in one case.