Attackers abuse Microsoft Teams external chat to pose as IT support, Arctic Wolf says
Arctic Wolf says attackers use throwaway Teams tenants and fake IT support names to get staff to start remote-access sessions on their computers.
Arctic Wolf Labs said on 26 October 2026 that attackers are abusing the external chat feature in Microsoft Teams to reach employees at other organisations. The chats come from new or throwaway tenants that pose as internal IT support, and they aim to get staff to start a remote-access session on their computers.
The company's blog post, written by Shubham Dubey, cites more than 400 incidents in its key findings and describes hundreds of cases in its summary. Arctic Wolf says the activity does not exploit a known Teams vulnerability. It relies on a default setting and on social engineering.
How the chat-based IT support scam works
In a significant number of cases, customers reported that the Teams contact was preceded or accompanied by mail bombing, the flooding of a victim's inbox with hundreds of newsletter or subscription confirmations within minutes. The email storm is intended to manufacture urgency, and a Teams message from an 'IT support' contact then arrives moments later to offer to resolve the very same problem.
The Teams accounts can be provisioned within minutes. Arctic Wolf says 30 to 40 per cent of cases used default onmicrosoft.com tenants, which need no verification. Their names were IT-themed, such as 'helpdeskteam365'. Display names added terms such as '(Internal)', a first name, or the target's company name.
Recently identified paid domains were mostly.top (about 50%) and.com (about 40%), according to the post. Once in a chat, the attacker often calls the user from Teams and asks them to start Quick Assist, the Windows remote-help tool, and read back a six-digit code. Arctic Wolf lists Quick Assist as the most frequently used tool, and names AnyDesk, ScreenConnect and TeamViewer among other commonly observed tools.
When attackers seek persistence, they pivot to a commercial RMM tool. The post says several users can be targeted within about five minutes, and that in customer reports payload execution came in under 15 minutes once a victim engages.
What the malware chain and earlier cases show
In one case, which Arctic Wolf calls a 'potentially novel infection chain', the user ran a PowerShell command that downloaded an installer from Azure Blob Storage. The chain ended with a Python implant that started a further MSI transaction issuing LDAP queries against Active Directory and sent the results to command-and-control endpoints.
The post does not report ransomware deployment in that case. It mentions Black Basta, Cactus, 3AM and Chaos only in the context of other campaigns. The post describes LDAP reconnaissance in that case.
Arctic Wolf's bulletin of 10 July 2026 described two earlier intrusions, on 23 June and 6 July 2026, that both began with external Teams contact and a Quick Assist session. The first, at a U.S. food and beverage organisation, led to encrypted tunnelling proxies, and Arctic Wolf observed no lateral movement in either intrusion. The second, at an international manufacturer with users in Germany, led to a tunnelling implant with persistence via a Run key or a hidden scheduled task.
Arctic Wolf says its alerts most often fire at the ChatCreated stage, before the user acts. It calls this the main detection point for defenders.
The Teams and Defender settings that limit outside contact
Microsoft's documentation says external access is on by default. All external domains are allowed, and both an organisation setting and a user policy must permit outside chat. Arctic Wolf says a user in another Microsoft 365 tenant can reach an employee if both tenants allow external access.
Admins can allow only specific external domains, block specific domains, or block all external domains. Arctic Wolf recommends moving from allow-all to a list of actively used partner domains in the Teams admin centre, under Users and then External access. It also recommends blocking chat with unmanaged Teams accounts.
For trial-only tenants, the post lists the PowerShell setting ExternalAccessWithTrialTenants set to Blocked. Microsoft's page gives Blocked as the default for that setting, while Arctic Wolf lists it as a step to take.
Admins can also let security staff manage blocked Teams domains in Microsoft Defender. Microsoft says this feature is in public preview and requires Defender for Office 365 Plan 1 or Plan 2. Arctic Wolf advises using the Teams domains tab of the Tenant Allow/Block List to block indicators such as the.top domains it lists.
“External access in Teams is on by default, which lets a user in another Microsoft 365 tenant reach an employee if both tenants allow external access.”
Endpoint and staff steps, and what is still open
On endpoints, Arctic Wolf recommends limiting Quick Assist to authorised IT roles, or removing it where it is not used. It also recommends blocking or uninstalling unsanctioned remote tools, and raising alerts on any remote tool not deployed through the Arctic Wolf agent.
For staff, the post recommends out-of-band checks, such as a callback to a registered number, before any remote-access request is approved. Its July bulletin described user behaviour under pressure as the weakest link.
Microsoft's support page says a user who receives a one-to-one chat from outside can accept, block or report the sender. Reports are shared with the IT admin, and the sender is not notified.
