Microsoft Alerts Users as Hackers Exploit Teams Features to Spread Malware

Microsoft is urging organizations to harden Microsoft Teams as threat actors increasingly abuse its built-in collaboration features chat, meetings, voice/video, screen sharing, and app integrations to gain initial access, persist, move laterally, and exfiltrate data.

While Microsoft’s Secure Future Initiative has strengthened defaults, effective defense requires actively tuning identity, endpoint, data/app, and network controls around real-world attack techniques observed across multiple campaigns.

Threat actors begin with reconnaissance by enumerating users, teams, channels, tenant configurations, and cross-tenant policies through Microsoft Graph and open-source tooling.

Presence visibility, external access, multi-tenant collaboration, and guest/anonymous settings can expose valuable signals when privacy and federation restrictions are lax.

Adversaries map relationships, privileges, and external communication permissiveness to craft targeted social engineering and phishing lures.

For resource development and pretexting, actors increasingly weaponize legitimate Entra ID tenants, custom domains, and branded assets to impersonate internal help desks or IT.

They schedule private Teams meetings, leverage voice/video and screen-sharing, and pair this with phone-based vishing to increase credibility.

Recent campaigns mirror this playbook, with actors spoofing IT workflows, faking automated notifications, and using Teams-like branding to push credential theft, remote access tools, and loaders for ransomware operations.

Initial access commonly hinges on social engineering via Teams chat and meetings: distributing RMM tools, directing users to drive-by download sites, or delivering payloads like DarkGate under the guise of tech support.

Malvertising has also been used to distribute fake Teams installers that deploy information stealers.

Actors exploit adaptive authentication flows and MFA fatigue, enroll alternate factors, or steal tokens via device code phishing to hijack sessions and maintain access.

Once in, persistence may be established by abusing startup shortcuts, accessibility features, or adding guest users and credentials to Teams accounts.

With valid refresh tokens, actors can impersonate users over Teams APIs, request OAuth tokens, and enumerate apps, files, and conversations.

Discovery includes enumerating Entra configurations, roles, groups, and devices; some state-aligned actors have accessed Teams web clients and delivered ZIPs for further domain exploration.

Lateral movement can follow from compromised admin roles or by abusing external communication and tenant trust settings.

Actors have impersonated IT personnel across organizations to gain remote access and expand control.

Collection focuses on Teams chats, channels, and linked data in OneDrive/SharePoint, with tooling capable of exporting conversations and context.

For command and control, adversaries hide communications in Teams messages, adaptive cards, or webhook flows, and may piggyback on legitimate remote access for interactive control.

Network-layer controls, conditional access, and continuous audit of admin role assignments help contain privilege escalation and cross-tenant abuse.

Proactive monitoring for Teams-specific signals suspicious meeting invites, rapid chat outreach patterns, unexpected bot/app activity, and anomalous presence access can disrupt these campaigns before impact.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.