Rise of External Chat Exploitation: Microsoft Teams Under Threat
Recent research conducted by Arctic Wolf has revealed alarming tactics employed by threat actors who are exploiting Microsoft Teams’ external chat creation feature. These malicious individuals are targeting employees as a means of gaining initial access to organizations, a trend that highlights the increasing sophistication of cyberattacks in the corporate sphere.
In their analysis, Arctic Wolf reported observing over 400 incidents where this feature was misused. The research indicated that the attackers frequently utilize "highly consistent" techniques, specifically impersonating IT support personnel. According to the findings, the process from initial contact to payload execution takes less than 15 minutes, underscoring the rapid pace at which these attacks unfold.
Notably, the researchers found that the attackers often focus on multiple victims within short time frames. This rapid targeting behavior suggests a potential reliance on automated tools to execute their schemes efficiently. The Arctic Wolf report, published on October 26, 2026, elaborated on the various strategies attackers deploy, stating, “Across the activity examined, attackers combined email bombing, convincing IT-support impersonation, newly created tenants and domains, and rapid social engineering to transition victims from a seemingly routine chat to remote access and payload execution.”
While the researchers did not identify the specific groups behind these attacks, there is evidence that the misuse of external Teams chat as a means of entry has been employed by notorious ransomware factions, including Black Basta.
The Mechanics of the Attack
Arctic Wolf emphasized that the external chat feature in Microsoft Teams has evolved into a potent platform for social engineering attacks. Importantly, this feature is enabled by default, allowing any Teams user from another Microsoft 365 tenant to connect with employees of different organizations, as long as both parties consent to external communications. Given this ease of access, nefarious actors have found fertile ground for launching their attacks.
In many of the documented incidents, threat actors managed to create external Teams identities using newly established or acquired Microsoft 365 tenants. The report discovered that in about 30-40% of the cases, attackers were operating under default “onmicrosoft.com” tenant domains. These domains can be registered without verification, making them easy targets for cybercriminals.
The attackers typically chose names that evoked a sense of trust, often using terms related to IT support or help desks, and would append numbers like "365" to enhance believability. In a few instances, they even incorporated the names of legitimate companies into their aliases to further manipulate their victims.
One particularly prevalent tactic observed was "email bombing," where the attackers inundated the target’s inbox with a barrage of fake newsletter or subscription confirmations. Just moments later, they would send a Teams message positioning themselves as IT support, purporting to help with the problem they had just created.
Once the initial interaction occurred, the attackers aimed to gain direct access to the target’s system using legitimate remote monitoring and management (RMM) tools, most commonly Windows’ Quick Assist, which doesn’t require any software installation. For long-term access, they would then pivot to commercial RMM tools like AnyDesk or ScreenConnect, allowing them to deploy malwares such as PowerShell payloads for lateral movements throughout the organization’s network.
In some instances, victims were even instructed to run specific PowerShell commands that facilitated the installation of malicious files on their systems.
Protecting Against Teams Exploitation
In response to these concerning trends, Arctic Wolf has put forward a series of recommendations aimed at fortifying defenses against such threats. These preventative measures include:
-
Restrict External Access: Teams administrators should navigate to the admin center, and under Users → External Access, select the option to "Allow only specific external domains." It’s crucial to add only those domains with which the organization actively collaborates.
-
Block Unmanaged Accounts: Organizations should block chats with unmanaged or Teams-consumer accounts and disable the functionality that lets unmanaged users initiate conversations with employees.
-
Restrict Trial Tenants: Blocking federation with trial-only tenants is advisable, as attackers often prefer these free or trial accounts for their low barrier to entry.
-
Management Control: Enabling the "Allow my security team to manage blocked domains" option will empower security teams to implement blocks efficiently.
-
Limit RMM Access: Quick Assist should be restricted to authorized IT personnel, while unsanctioned remote management tools should be blocked or uninstalled entirely.
-
User Education: Training staff to recognize the signs of these types of threats is essential. This includes teaching employees how legitimate IT support reaches out and instructing them to scrutinize the "External" tag on messages and the real sender domain.
- Utilizing Microsoft Tools: Employees should be made aware of Microsoft’s end-user reporting features in Teams, which allow them to report suspicious messages or external users with minimal effort.
In light of these findings, it is imperative for organizations utilizing Microsoft Teams to adopt comprehensive security measures. By staying informed and proactive in their approach to cyber threats, businesses can better safeguard their networks against malevolent infiltration.