Fake Microsoft Teams IT Support Messages Lead to Remote Access and Malware Infections

More than 400 incidents in which attackers abused Microsoft Teams external chats to impersonate IT support, obtain remote access, and deliver malware.

Researchers identified recurring tenant names, deceptive display names, remote administration tools, and payload infrastructure across incidents.

Teams federation, enabled by default, allows communication between organizations when both tenants permit external access.

Attackers exploit this legitimate capability to approach employees without first compromising an account inside the targeted organization.

Many attacks begin with email bombing: hundreds of subscription confirmations flood an employee’s inbox. A Teams message or call then arrives from supposed support personnel offering assistance.

Microsoft previously documented this sequence in Storm-1811 operations associated with Black Basta ransomware

Attackers frequently append “(Internal)” to names such as “IT Support,” attempting to counteract Teams’ external-user warning.

Friendly first names, corporate branding, and security-themed symbols reinforce the disguise. Arctic Wolf also observed identities incorporating the target organization’s name or domain to make unsolicited contact appear credible.

Between 30 and 40 percent of analyzed cases involved default onmicrosoft[.]com domains.

Arctic Wolf Labs has observed that, the activity exploits trust in workplace collaboration tools rather than a software vulnerability, turning seemingly routine helpdesk conversations into entry points for compromise.

Fake IT Support Scams

Among identified paid-domain cases, approximately half used .top, around 40 percent used .com, and just over five percent used multilevel domains. These percentages describe separate infrastructure categories, not the entire incident population.

Once victims engage, attackers commonly request a Teams voice call and guide them into granting remote access.

Quick Assist was the most frequently observed tool, alongside AnyDesk, ScreenConnect, TeamViewer, Atera, and others.

Quick Assist requires user approval for screen sharing and subsequent control; a connection code alone does not authorize full access.

Commercial remote management software can subsequently provide persistent access independent of the original session. Customer-reported attack chains reached payload execution in under 15 minutes.

Attackers also contacted multiple employees within approximately five-minute windows, behavior Arctic Wolf assessed as likely automated.

Related Sophos research into STAC4749 documented IT-themed .top identities, Teams voice phishing, and remote access preceding Chaos ransomware deployment.

At least three investigated compromises culminated in encryption, demonstrating the potential consequences of this initial-access technique without establishing that every observed campaign shares an operator.

In one Arctic Wolf investigation, an impersonated helpdesk worker persuaded a victim to execute PowerShell and launch an MSI downloaded from Azure Blob Storage.

The installer bundled cleaner.ps1 and archive6.zip. The script decoded hexadecimal content, decrypted an embedded AES-protected payload, verified its hash, and executed the resulting PowerShell through ScriptBlock.

The resulting stage extracted pythonw.exe and ss.py, then launched the implant. A subsequent MSI transaction issued LDAP queries against Active Directory access, enumerating computer and user objects.

The implant transmitted collected account names and descriptions to command-and-control endpoints selected from lists embedded in the implant.

Arctic Wolf identifies ChatCreated as an early detection opportunity, before a recipient responds.

Defenders should correlate suspicious external chats with inbox floods, remote-tool execution, PowerShell activity, and identity alerts.

Organizations should restrict unnecessary federation, control approved support software, and require employees to verify unexpected helpdesk requests through established internal channels before granting access or executing commands.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.