Attackers are exploiting Microsoft Teams' external chat feature to gain initial access into organizations, with payload execution reached in under 15 minutes from when a victim responds to the initial social engineering message, according to new research by Arctic Wolf. The cybersecurity firm documented more than 400 incidents where the external chat function was misused, with attackers deploying "highly consistent" IT-support impersonation methods. The threat actors frequently target multiple victims in short time windows, suggesting they're using automation to scale their attacks.

In the observed cases, the attackers created external Teams identities through newly created or acquired Microsoft 365 tenants. Between 30% and 40% of the incidents involved default onmicrosoft[.]com tenant domains, which don't need verification and can be set up within minutes. The malicious actors typically chose a support-, IT-, admin-, network-, or helpdesk-themed word as the tenant name, sometimes adding the number 365 as a suffix, to masquerade as an IT-support worker. They also used fake first names like "IT Service Desk – Liam" to make it seem as though the message originated from a genuine member of the organization's service desk. In a "significant number" of attacks, the target's email was flooded with hundreds of newsletter or subscription confirmations within minutes—a technique called mail bombing—before the attackers sent a Teams "IT support" message moments later offering to fix the very problem they'd just created.

After making initial contact, the attackers' primary goal in most cases was to gain hands-on-keyboard access through legitimate remote monitoring and management tools, most often Quick Assist, which is built into Windows and therefore doesn't require installation. When the attackers want persistence beyond the initial call, they switch to a commercial RMM tool such as AnyDesk and ScreenConnect. The researchers wrote that the attack chain combines email bombing, convincing IT-support impersonation, newly created tenants and domains, and rapid social engineering to move victims from what appears to be a routine chat to remote access, payload execution, and in some cases broader compromise. The researchers didn't identify who's behind these attacks, but noted that using external Teams chat as an initial access vector has been a tactic deployed by ransomware groups including Black Basta.

The vulnerability stems from how Teams' external access is configured by default: any Teams user in another Microsoft 365 tenant can find, chat with, and call an organization's employees, provided both tenants allow external access. This design makes it an effective platform for launching social engineering, with attackers able to make themselves appear legitimate to users. Once remote access is established through the RMM tools, attackers can execute PowerShell payloads and undertake lateral movement across the organization's network for purposes such as ransomware deployment.

The Arctic Wolf researchers recommend several defensive measures, including changing Teams admin center settings to allow only specific external domains that the organization actively works with, blocking chat with unmanaged or Teams-consumer accounts, and disabling the option that lets unmanaged users start conversations. They also suggest blocking federation with trial-only tenants, since attackers commonly prefer free or trial tenants for their minimal setup requirements, and blocking or restricting Quick Assist to authorized IT roles while blocking or uninstalling unsanctioned RMM tools. Staff education is critical: employees should know exactly how real IT support reaches out, be trained to read the External tag and the real sender domain, and be made aware of Microsoft's end-user reporting tool in Teams, which allows them to report a suspicious message or an external user with a couple of clicks. The speed and scale of these attacks—from first contact to full compromise in minutes, across hundreds of incidents—suggests that organizations treating Teams as a trusted internal communication platform may be leaving a wide-open door for sophisticated social engineering. The tension between collaboration convenience and security controls will likely intensify as attackers continue to weaponize the same external access features that make remote work possible.