Attackers use Microsoft Teams IT support scams to deploy malware

Attackers are using Microsoft Teams chats to impersonate internal IT support, persuade staff to grant remote access and deliver malware that can lead to ransomware deployment, according to cybersecurity researchers. The campaign pattern has appeared across hundreds of investigated cases, with attackers repeatedly using the same support-themed identities, throwaway Microsoft 365 tenants and remote-access tools. ¹²

Arctic Wolf Labs, whose findings were reported by The Hacker News, says the messages often come from newly created or acquired Microsoft 365 tenants. The accounts use names such as “IT Support”, “Help Desk” or “Enterprise IT & Security (Internal)” to make an external contact look trustworthy, even when Teams displays a warning that the user is outside the organisation. ¹

How the Teams scams work

The attacks commonly begin with mail bombing: a target receives a sudden flood of newsletter or subscription confirmations, then gets a Teams message offering to help resolve the apparent problem. The timing is designed to create urgency and make an unexpected support request feel like a plausible explanation for the disruption. ¹

The attackers then try to persuade victims to run a legitimate remote-monitoring tool such as Quick Assist, AnyDesk, ScreenConnect, TeamViewer or LogMeIn. Once they have hands-on-keyboard access, they can perform reconnaissance, deploy further tools and move towards sensitive systems. Some incidents have involved Chaos ransomware, according to reporting cited by The Hacker News. ¹

Arctic Wolf says the threat actors have also used plausible-looking tenant names and paid top-level domains. Among paid domains observed in the cases it examined, roughly half used .top, while about 40 per cent used .com. The goal is not to exploit a Teams software flaw; it is to exploit the trust people place in a message that appears to come from their own IT department. ¹

In one example, a victim was instructed to run a PowerShell command that downloaded an MSI installer from Azure Blob Storage. The installer launched a script containing a Python implant, which then issued LDAP queries for Active Directory data and sent the results to an external server. That chain shows how a conversation that begins with a fake support identity can become a wider network compromise. ¹

Microsoft Teams external chat is therefore an important monitoring surface for organisations with external access enabled. Security teams should treat unsolicited IT-support messages, unexpected remote-access requests and instructions to run PowerShell as warning signs, especially when they arrive alongside a sudden burst of nuisance email. ¹³

Our opinion

The nasty part of this campaign is how little technical theatre it needs. A fake help-desk name, a carefully timed message and a familiar remote-support app can bypass the instincts people have built around suspicious attachments and obviously malicious links. Organisations should make external Teams identities easy to distinguish, restrict remote-support tooling where practical and rehearse a simple rule: genuine IT staff should not ask a user to defeat security warnings or run an unexplained command.

The hero image is an abstract encryption photograph by Ann H on Pexels; it represents the ransomware and data-theft risk without pretending to show a specific Microsoft Teams incident. ⁴