Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
Summary: Arctic Wolf Labs documented hundreds of cases where attackers used Microsoft Teams' external chat creation feature, posing as "IT Support (Internal)" from throwaway Microsoft 365 tenants to impersonate help desk staff and deliver malware. In 30-40% of investigated cases the attackers used *.onmicrosoft[.]com fallback domains, often preceded by mail bombing the victim's inbox with hundreds of subscription confirmations, and the activity aligns with STAC4749 and has led to Chaos ransomware deployment, according to Sophos.
What you should know: The attacks target organizations with external Teams access enabled and rely on vishing to get victims to grant hands-on-keyboard access through legitimate RMM tools like Quick Assist, AnyDesk and ScreenConnect - meaning the remote access your IT team uses for support is the same channel attackers use to reach domain controllers and exfiltrate data.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026