Hackers use Microsoft Teams messages and calls to gain remote access
Attackers impersonate IT support via Teams to approve Quick Assist sessions and abuse AD CS for privileged account access.
1
Stories per day · 30 days
3 RSS
Relatedquick-assist8social-engineering7ad-cs3phishing3impersonation2it-support-scam2microsoft-3652ransomware2remote-access2rmm2vishing2active-directory1black-basta1chaos1credential-theft1dcsync1email-bombing1esc11
34 stories, newest first · one card per story
Stories tagged #microsoft-teams
Fake Teams IT help desk sessions abused AD CS for domain access
Two Microsoft-disclosed intrusions used Quick Assist plus ESC1 or ESC8, then DCSync and Rclone in one case.
2
Teams help-desk lures led to AD CS ESC1 and ESC8 abuse
Two unattributed intrusions used Quick Assist; one reached DCSync and exfiltration after a privileged identity was excluded from containment.
Email bombing and external Teams chats used for remote access
Arctic Wolf reports the pattern in more than 400 incidents, with Quick Assist most often used before credential theft.
1
Spam floods precede fake IT-support chats in Microsoft Teams
Arctic Wolf documented more than 400 cases; remote-access tools can be installed in under 15 minutes, sometimes leading to ransomware.
1
Attackers abuse Teams external chat to breach organizations quickly
Arctic Wolf saw more than 400 cases, often with email bombing and Quick Assist, and did not name the operators.
2
Fake Microsoft Teams IT support used for remote access and malware
Arctic Wolf tied more than 400 cases to external chats, inbox floods, and tools such as Quick Assist, sometimes within 15 minutes.
1
Microsoft restores Teams after US disruption tracked as TM1526111
Automatic scaling returned throughput to healthy levels on October 26, but Microsoft has not named the trigger, user count or affected features.
1
Teams IT-support impersonation used to deploy malware and ransomware
Arctic Wolf ties hundreds of cases to throwaway Microsoft 365 tenants, mail bombing, RMM tools, and sometimes Chaos ransomware.
1
Microsoft Teams will use AI to detect phishing in external chats
Targeted Release runs through mid-November and worldwide availability is set for mid-December, with no admin setup required.
1
Microsoft Teams to get AI-powered, context-aware phishing detection
Admins need not enable it, and Microsoft says message content is not kept for model training.
1
Five-day-old domain copies Microsoft Teams login, researcher warns
Steven Lim flagged teams-cloud.live on October 18 and urged blocking; captured passwords and malware are unconfirmed.
1
Lawmakers warn Google could expose Spirit Airlines data in $10 million AI training deal
Lawmakers urged Google and Spirit to halt a $10 million AI-training data deal over re-identification risks to employee records.
Microsoft Teams Adds Synthetic Audio and Video Detection to Fight Deepfake Meeting Attacks
Microsoft Teams will surface third-party synthetic audio and video detection, with rollout planned from November 2026.
4
Hackers Registered New Domain with Exact Microsoft Teams Interface to Steal Logins
A four-day-old domain, teams-online.com, clones the Microsoft Teams login page to steal work credentials.
4
OpenAI's reveals a new ChatGPT that looks less like a chatbot and more like an operating system
OpenAI's DevDay turns ChatGPT into a workspace with plugins, shared Spaces, and Slack and Teams integration.
Hackers Impersonate IT Help Desk on Microsoft Teams to Steal Windows Passwords
Attackers impersonate IT help desks in Microsoft Teams to deliver SynkLoader and steal Windows passwords.
2
Microsoft Investigating Teams Calling Issue Blocking Some Users From Making or Receiving Calls
Microsoft is investigating a Teams incident blocking some users from making or receiving calls.
1
Hackers Abuse Microsoft Teams to Pose as IT Support and Steal Employee Passwords
Threat actors impersonate IT support in Microsoft Teams chats to deliver SynkLoader malware and harvest Windows credentials via fake lock screens.
1
Microsoft Teams will let admins block custom file extensions
Microsoft Teams will let admins customize blocked file extensions in Weaponizable File Protection, rolling out globally from November 2026 across all platforms.
1
Update your firewall rules: Teams and Copilot are changing address
Microsoft is redirecting Microsoft 365 and Teams web users to new *.cloud.microsoft domains, requiring firewall and proxy rule updates by early October.
Hackers Use Blob URLs and Microsoft Teams to Create Phishing Pages Inside Victims’ Browsers
Barracuda details a phishing campaign using Microsoft Teams OAuth redirects and browser blob URLs to render local fake DocuSign login pages for credential theft.
1
New Phishing Attack Uses Blob URLs to Hide Malicious Pages From Security Scanners
Barracuda detailed a DocuSign-themed phishing campaign that renders credential-harvesting pages as browser blob URLs, evading URL reputation and blocklist defenses.
Cybercriminals are building phishing pages that exist only inside victims’ browsers
Barracuda details a DocuSign-themed phishing campaign that renders login pages locally via blob URLs, abusing genuine Microsoft OAuth and Teams infrastructure.