- Arctic Wolf analyzed more than 400 incidents involving abuse of Microsoft Teams external chat.
- Customer-reported attack chains reached payload execution in under 15 minutes after a victim engaged.
- The activity abused a legitimate, default-on Teams capability rather than a known Teams vulnerability.
Arctic Wolf reported on Oct 26, 2026, that threat actors had abused Microsoft Teams external chat in more than 400 incidents involving social engineering and initial access.
Attackers used IT-themed display names and Internal labels, then reached payload execution in under 15 minutes after a victim engaged, according to customer-reported attack chains.
On this page
Attackers used Teams impersonation and remote-access tools
Arctic Wolf said attackers repeatedly used IT-support impersonation, friendly-sounding first names and Internal labels to undermine external-user warnings in Teams. Between 30 and 40 percent of analyzed cases involved default onmicrosoft.com tenant domains that require no verification and can be provisioned within minutes.
One attack chain began with a PowerShell command
In one observed case, the attacker instructed a user to run a PowerShell command and launch the downloaded file.
Arctic Wolf recommends allowing external Teams chats only with specific partner domains. It also recommends restricting Quick Assist to authorized IT roles, removing it where unused, and blocking or uninstalling unsanctioned remote-monitoring tools.
Arctic Wolf said the activity does not exploit any known Teams vulnerability and abuses a legitimate, default-on collaboration capability.
What to do now
- Harden the remote-access path: block or restrict Quick Assist to authorized IT roles, or remove it where unused, and block or uninstall unsanctioned RMM tools.
FAQ
What happened in the Microsoft Teams external chat campaign?
Arctic Wolf analyzed more than 400 incidents involving abuse of Teams external chat for social engineering and initial access.
How quickly could attackers execute a payload?
Customer-reported attack chains showed threat actors reaching payload execution in under 15 minutes after a victim engaged.
Does this campaign exploit a Microsoft Teams vulnerability?
Arctic Wolf said the activity does not exploit a known Teams vulnerability. It abuses a legitimate, default-on collaboration capability.
Who could be affected by the Teams activity?
Organizations that allow external Teams access could receive chats, calls or contact requests from users in other Microsoft 365 tenants when both tenants allow external access.
How can organizations restrict this Teams activity?
Arctic Wolf recommends selecting “Allow only specific external domains” in Teams admin center and adding only partner domains the organization actively collaborates with.
Sources
- Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access - Arctic Wolf, Arctic WolfPrimary
- External Teams Chats Anchor 15-Minute Malware Delivery, Dark Reading
- Attackers Exploit Teams External Chat to Breach Organizations in Under 15 Minutes, Infosecurity Magazine
- Microsoft Teams phishing pushes DarkGate malware via group chats, BleepingComputer
How we checked this story
| Claim | Source | Status |
|---|---|---|
| Arctic Wolf analyzed more than 400 incidents involving abuse of Microsoft Teams external chat for social engineering and initial access. | Arctic Wolf | Confirmed |
| Microsoft Teams external access is turned on by default, allowing users in other Microsoft 365 tenants to find, chat with and call employees when both tenants allow it. | Arctic Wolf | Confirmed |
| Between 30 and 40 percent of analyzed cases involved default onmicrosoft.com tenant domains that require no verification and can be provisioned within minutes. | Arctic Wolf | Confirmed |
| Attackers used IT-themed display names and Internal labels to undermine external-user warnings in Teams. | Arctic Wolf | Confirmed |
| Attackers reached payload execution in under 15 minutes after a victim engaged, according to customer-reported attack chains. | Arctic Wolf | Confirmed |
| In one observed case, an attacker instructed a user to run a PowerShell command and launch the downloaded file. | Arctic Wolf | Confirmed |
| Arctic Wolf said the activity does not exploit a known Teams vulnerability but abuses a legitimate, default-on collaboration capability. | Arctic Wolf | Confirmed |
| Arctic Wolf recommends allowing external Teams chats only with specific partner domains. | Arctic Wolf | Confirmed |
| Infosecurity Magazine reported that researchers observed more than 400 incidents involving abuse of Teams external chat. | Infosecurity Magazine | Attributed |
| Infosecurity Magazine reported that the research report was published on October 26, 2026. | Infosecurity Magazine | Attributed |
| BleepingComputer reported that new phishing attacks abused Microsoft Teams group chat requests to deliver malicious attachments installing DarkGate. | BleepingComputer | Attributed |
| arcticwolf.com published its report on Oct 26, 2026. | arcticwolf.com | Confirmed |
Could not verify
- Whether the campaign was conducted by Black Basta is not established.
- Whether the activity involved in-the-wild exploitation of a software vulnerability is not established.
- How many organizations or victims were compromised is not established.
- Whether the DarkGate activity reported by BleepingComputer is linked to the Arctic Wolf campaign is not established.
Related stories
AI-Powered AttacksMicrosoft Teams external chat abused to gain initial access
Vulns & PatchesPHP flaws could run code after CISA added two CVEs to KEV
Vulns & PatchesInterSystems IRIS for Health flaw could expose data and log in