- What: Attackers are flooding employee inboxes with junk mail, then messaging them on Microsoft Teams as fake internal IT support from throwaway Microsoft 365 tenants to gain remote access.
- Impact: Across hundreds of cases tracked by Arctic Wolf Labs, the chats have led to backdoors such as GoGRPC, lateral movement to domain controllers, data exfiltration and, per Sophos, Chaos ransomware.
- Fix / mitigation: There is no patch because no software flaw is involved; the mitigation is restricting Teams external access, controlling which RMM tools can run, and watching endpoint and identity telemetry, since attackers avoid URLs that would trigger Safe Links and ZAP scanning.
- Who's at risk: Any organization running Microsoft Teams with external access enabled, especially those whose staff are used to getting help desk support through chat.
An employee's inbox fills with hundreds of newsletter sign-ups and subscription confirmations in a few minutes. Moments later, a Microsoft Teams message arrives from "IT Support (Internal)" offering to fix it. The help is fake. The remote session that follows is real, and in some cases it ends with Chaos ransomware across the network.
Arctic Wolf Labs, in a report shared with The Hacker News, describes this as a "recurring social engineering pattern" seen across hundreds of cases. The playbook barely changes from victim to victim: "the same throwaway tenants, the same 'IT Support (Internal)' display names, the same remote-access tools, and increasingly, the same payload domains." Every step is something security teams have seen before. What has changed is how reliably the steps now work together.
The setup: a tenant that looks like your help desk
The attackers create or buy Microsoft 365 tenants and send messages through Teams' external chat feature. Arctic Wolf found that 30 to 40% of the cases it investigated used *.onmicrosoft.com, the permanent fallback domain Microsoft generates automatically when a tenant is created. The tenant names are picked to sound like internal IT: helpdeskteam365, itendpoint365, itcoreportal, itadmin922 and corporateitservicellc.
Display names do the rest. Observed examples include "Help Desk IT Support," "IT Service Desk (Liam)," "HelpDesk Supervisor," "Enterprise IT & Security (Internal)" and "IT/Help Desk." In recent versions, attackers add the target's own company name or domain to the display name. The goal, according to Arctic Wolf, is to get past the external-user warnings Teams shows, using a label that reads as internal and trusted.
The infrastructure is also getting more professional. Over the past few months, Arctic Wolf saw a move toward paid domains for tenant creation. Among those, about 50 percent of the fake identities used .top, around 40 percent used a standard .com, and just over five percent used multi-level domains such as .com.pl, .com.vn and .com.br. The activity matches STAC4749, a cluster known for registering IT-themed .top domains and using believable employee usernames.
Arctic Wolf notes that attackers generally avoid pasting a URL into Teams, because that would trigger Safe Links and ZAP scanning. Instead, they browse to the payload themselves during the remote session. Message scanning alone will miss the step that matters.
From chat to domain controller
The attacks target organizations that allow external access in Teams. After the mail bomb creates urgency and the chat builds trust, the attacker moves to voice and talks the victim into granting hands-on-keyboard access through a legitimate remote monitoring and management (RMM) tool. Named tools include Quick Assist, AnyDesk, ScreenConnect (ConnectWise), TeamViewer, Atera, Zoho Assist, NetSupport and LogMeIn.
With access in place, the operator carries out reconnaissance, delivers payloads such as the GoGRPC backdoor, moves laterally toward domain controllers and installs more RMM tooling, such as Level, as a backup way in. Sensitive data is exfiltrated before the ransomware binary runs. Sophos has tied these attacks to Chaos ransomware deployments.
One case Arctic Wolf described shows how little the victim has to do. The user was told to run a PowerShell command that downloaded an MSI installer from Microsoft Azure Blob Storage. The installer launched a PowerShell script that extracted and ran an embedded Python implant. That backdoor started a second MSI transaction, which ran LDAP queries against Active Directory for every computer and user object and sent the results to an external server. One chat gave the attacker a full map of the directory.
The RedEye take
This campaign is not clever, and that is what should worry defenders. Arctic Wolf's own summary says it plainly: external Teams chat works as an initial access vector "because it exploits trust rather than a software vulnerability." No CVE is involved and no patch is coming. Each piece of the chain is a feature working as designed: open federation, free fallback domains, display names users can edit, and remote support tools that IT teams installed on purpose.
For years, many organizations have treated Teams as an internal space and email as the dangerous outside world. Attackers have taken advantage of that gap. They use email only to create the panic, then use a chat channel that employees trust more and that security teams watch less. If your awareness training still says "be careful with email links," it is aimed at the wrong channel, because in this campaign the link never appears in a message.
The most telling signal is repetition. The same tenants, display names and tools keep showing up across hundreds of cases. When an attacker can reuse one playbook that often, defenders have not yet raised the cost enough to force a change.
What defenders should learn
- External Teams access is an attack surface, not just a collaboration setting. The campaign specifically targets tenants with external access enabled, so whoever decides federation policy is making a security decision and should be held accountable for it.
- A mail bomb is a warning sign, not just an annoyance. Hundreds of sign-up confirmations in minutes is the attacker's opening move, and help desk and SOC staff should treat it as a likely sign that a social engineering call or chat is about to follow.
- Your approved RMM list is part of your perimeter. Eight legitimate tools were abused here, and Level was added for persistence. Any remote support tool your organization does not officially use should be treated as an incident on discovery.
- Endpoint and identity telemetry matter more than message scanning for this threat. Because payloads are fetched during live sessions, the useful detections are an RMM session starting, PowerShell pulling an MSI from cloud storage, or a sudden burst of LDAP queries for every user and computer object.
- Employees need a real way to verify IT. If staff cannot quickly confirm that a help desk contact is genuine, a display name containing your company name will be enough to fool them.
Reporting based on The Hacker News, "Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware" (Ravie Lakshmanan, October 26, 2026), citing research from Arctic Wolf Labs and Sophos: https://thehackernews.com/2026/10/attackers-use-microsoft-teams-it.html
Questions about your exposure?
RedEye Security provides assessments for organizations that need to understand their real risk.
Talk to us