- Arctic Wolf analyzed more than 400 incidents involving abuse of Microsoft Teams external chat for social engineering and initial access.
- Attackers repeatedly used IT-themed names, friendly first names and Internal labels to weaken external-user warnings.
- The activity did not exploit a known Teams vulnerability, according to Arctic Wolf.
Attackers abused Microsoft Teams external chat to impersonate IT support and seek initial access, Arctic Wolf Labs said on Oct 26, 2026. The activity involved more than 400 incidents analyzed by the security company.
Attackers used IT-themed display names, friendly first names and Internal labels to undermine external-user warnings in Teams.
Arctic Wolf said the activity did not exploit a known Teams vulnerability. Instead, it abused a legitimate, default-on collaboration capability.
On this page
Attackers paired fake support identities with rapid targeting
Arctic Wolf Labs said between 30 and 40 percent of the analyzed cases involved default onmicrosoft.com tenant domains. Those domains require no verification and could be provisioned within minutes, giving attackers a functioning Teams identity with minimal setup.
Among paid domains identified in these scams, approximately 50 percent used the .top top-level domain, around 40 percent used .com and just over five percent used multilevel domains such as .com.pl, .com.vn and .com.br.
In a significant number of cases, malicious Teams contacts were preceded or accompanied by mail bombing. Customers reported inboxes being flooded with hundreds of newsletter or subscription confirmations within minutes.
Attackers commonly targeted multiple users within approximately five minutes, likely through automation, and customer-reported attack chains reached payload execution in under 15 minutes after engagement.
What happened
Arctic Wolf listed Quick Assist, AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport and LogMeIn among the most commonly observed RMM tools used in the scams.
Arctic Wolf recommends restricting external chat and remote tools
Arctic Wolf recommends configuring Teams admin center external access to allow only specific trusted external domains, then adding only partner domains the organization actively collaborates with.
Arctic Wolf said defenders can detect the activity when a chat is created, before a user engages with the attacker. That creates a window to identify and disrupt the attack.
Arctic Wolf said attackers commonly targeted multiple users within approximately five minutes and, per customer reports, reached payload execution in under 15 minutes once a victim engaged.
What to do now
- Harden the remote-access path: block or restrict Quick Assist to authorized IT roles, or remove it where unused, and block or uninstall unsanctioned RMM tools.
FAQ
What happened in the Microsoft Teams external chat campaign?
Attackers abused Microsoft Teams external chat to impersonate IT support and seek initial access. Arctic Wolf analyzed more than 400 related incidents.
Did the attackers exploit a Microsoft Teams vulnerability?
No. Arctic Wolf said the activity did not exploit a known Teams vulnerability and instead abused a legitimate, default-on collaboration capability.
How did the attackers impersonate IT support in Teams?
They used IT-themed display names, friendly first names and Internal labels to undermine warnings that the users were external.
What remote-access tools were used in the Teams scams?
Arctic Wolf listed Quick Assist, AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport and LogMeIn as the most commonly observed RMM tools.
How fast could the attack progress after engagement?
Arctic Wolf said attackers commonly targeted multiple users within approximately five minutes and reached payload execution in under 15 minutes after a victim engaged.
Sources
- Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access - Arctic Wolf, Arctic Wolf LabsPrimary
- GhostCode: Dissecting a Novel Device Code Phishing Kit, eSentirePrimary
- OAuth redirection abuse enables phishing and malware delivery | Microsoft Security Blog, MicrosoftPrimary
- Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware, The Hacker News
- GhostCode attackers abuse device codes to take over Microsoft 365 accounts, Computerworld
How we checked this story
| Claim | Source | Status |
|---|---|---|
| Arctic Wolf Labs analyzed more than 400 incidents involving abuse of Microsoft Teams external chat for social engineering and initial access. | Arctic Wolf Labs | Confirmed |
| Arctic Wolf said attackers repeatedly used IT-themed display names, friendly first names and Internal labels to undermine Teams external-user warnings. | Arctic Wolf Labs | Confirmed |
| Arctic Wolf said between 30 and 40 percent of analyzed cases involved default onmicrosoft.com tenant domains that could be provisioned within minutes. | Arctic Wolf Labs | Confirmed |
| Arctic Wolf said paid-domain fake identities used .top domains in approximately 50 percent of identified cases, .com in around 40 percent and multilevel domains in just over five percent. | Arctic Wolf Labs | Confirmed |
| Arctic Wolf said mail bombing often preceded or accompanied malicious Teams contacts by flooding inboxes with hundreds of confirmations within minutes. | Arctic Wolf Labs | Confirmed |
| Arctic Wolf said attackers commonly targeted multiple users within approximately five minutes and reached payload execution in under 15 minutes after engagement. | Arctic Wolf Labs | Confirmed |
| Arctic Wolf said the reported activity did not exploit a known Teams vulnerability but abused a legitimate default-on collaboration capability. | Arctic Wolf Labs | Confirmed |
| Arctic Wolf recommends allowing external Teams chat only with specific trusted external domains. | Arctic Wolf Labs | Confirmed |
| Arctic Wolf said defenders can detect the activity at the ChatCreated stage before a user engages with the attacker. | Arctic Wolf Labs | Confirmed |
| The Hacker News reported that the attacks had led to deployment of Chaos ransomware, according to Sophos. | Sophos, via The Hacker News | Attributed |
| The Hacker News reported that the activity aligned with STAC4749, which had created IT-themed cloud domains under the .top top-level domain. | The Hacker News | Attributed |
| Computerworld reported that GhostCode exploited Microsoft’s OAuth 2.0 device authorization grant flow to obtain authentication tokens. | Computerworld | Attributed |
| Computerworld reported that attackers used the stolen tokens to register attacker-controlled devices, obtain additional credentials and establish persistence. | Computerworld | Attributed |
| Computerworld reported that the GhostCode campaign involved attackers posing as procurement officers before moving victims to an NDA-themed HTML file. | Computerworld | Attributed |
| Computerworld reported that eSentire recorded nine successful API calls over 78 seconds after authentication. | Computerworld | Attributed |
| Sentire said computerworld reported that three devices were registered 28, 53 and 77 seconds after authentication. | Sentire, via Computerworld | Attributed |
| Sentire said computerworld reported that the third device was enrolled into Intune and remained in the tenant until explicitly removed despite token revocation. | Sentire, via Computerworld | Attributed |
| Computerworld reported that eSentire called the obtained Primary Refresh Token one of the most powerful credentials in a Microsoft identity environment. | Computerworld | Attributed |
| eSentire said it identified GhostCode in late August 2026 as an active device-code phishing campaign distributed through web contact forms. | eSentire | Confirmed |
| eSentire said GhostCode victims were directed to Microsoft’s legitimate sign-in page and prompted to enter an attacker-supplied user code. | eSentire | Confirmed |
| eSentire said more than 30 similar domains impersonating US companies were registered in August 2026, suggesting a broader campaign targeting service providers. | eSentire | Confirmed |
| eSentire said attackers issued nine successful API calls using the stolen token over 78 seconds, with later requests using python-requests/2.34.2. | eSentire | Confirmed |
| eSentire said it revoked the compromised token grant, reset the victim’s credentials and disabled all three attacker-enrolled devices. | eSentire | Confirmed |
| eSentire said MFA does not protect against device-code phishing because the token carries the MFA claim forward. | eSentire | Confirmed |
| eSentire said GhostCode completed three device registrations and obtained a Primary Refresh Token in 78 seconds. | eSentire | Confirmed |
| Microsoft said attackers abused OAuth’s by-design redirection mechanisms in phishing campaigns targeting government and public-sector organizations. | Microsoft | Confirmed |
| Microsoft said attackers used malicious OAuth applications and manipulated parameters to redirect victims to attacker-controlled infrastructure. | Microsoft | Confirmed |
| Microsoft said several malicious OAuth applications were identified and removed to mitigate the threat. | Microsoft | Confirmed |
| Microsoft said attackers used OAuth redirect campaigns to deliver ZIP archives containing LNK shortcut files and HTML smuggling loaders. | Microsoft | Confirmed |
| arcticwolf.com published its report on Oct 26, 2026. | arcticwolf.com | Confirmed |
| esentire.com published its report on Sep 15, 2026. | esentire.com | Confirmed |
| Microsoft published its report on Mar 2, 2026. | Microsoft | Confirmed |
Could not verify
- Whether the campaign caused confirmed compromises or ransomware deployments beyond the cases described is not established
- How many organizations or users were affected is not established
- Whether the activity was operated by STAC4749 is not established
- Whether any Microsoft Teams vulnerability was exploited is not established
Related stories
AI-Powered AttacksOperation Serengeti III arrests 1,462 suspects across 21 countries
Vulns & PatchesNode.js Brotli flaw could enable remote code execution
Attacks on AIOpenAI API compaction smuggling could extract reasoning traces