Microsoft Teams is the new front door for attackers, and they’re posing as your help desk
For a decade, security teams trained employees to distrust email. Attackers moved to the tool employees trust most. Arctic Wolf’s October 26 report, Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access, documents more than 400 incidents in which attackers posed as IT support and talked staff into handing over their machines. No vulnerability was exploited. Teams worked exactly as designed.
How the attack unfolds
The attacker registers an external Microsoft 365 tenant, often on a default onmicrosoft.com domain (30 to 40 percent of cases), then buries the target under hundreds of newsletter confirmations. Minutes later, a Teams message from “IT Support (Internal)” offers to fix the flood. Teams labels the sender external, but a familiar name and a real problem usually win. A voice call follows, and the victim activates Quick Assist, AnyDesk or ScreenConnect. Quick Assist ships with Windows and is signed by Microsoft. In some cases, payload execution came within 15 minutes.
In one documented chain, the victim ran a PowerShell command, an implant was deployed, and Active Directory data went to attacker infrastructure. Microsoft’s September 2 research describes the same playbook, moving toward domain controllers.
Why this is a CIO problem
This is a trust failure, not a software flaw. Teams external access is on by default, so unknown tenants can reach every employee, and most organizations have no legitimate need for that. The employee grants access voluntarily, so there is no stolen password to detect. Credential-access alerts sometimes fired alongside the first Teams alert, which leaves defenders almost no time.
What to do now
Replace open federation with an allow-list of partner domains, and block chats from unmanaged accounts. Set a rule that no one grants remote access because someone claims to be IT; verification happens through a callback to the registered helpdesk number. Restrict Quick Assist and other remote tools to approved users, and alert on unapproved installs.
Then put Teams telemetry in the SOC. The ChatCreated event from an unknown external tenant is the cheapest interception available, and correlating email floods, new external chats, remote-tool execution, PowerShell and directory enumeration turns scattered alerts into one story. Rehearse the full chain in a tabletop, and teach staff that an “Internal” label proves nothing.
Indian enterprises carry extra exposure. Distributed or outsourced helpdesks and constant vendor contact make impersonation plausible, and in banking and IT services, one compromised workstation can expose customer data or a client’s environment.
The question is not whether employees use Teams. It is who can contact them, who can take control of their devices, and who is watching when it happens.