Attackers are using external Microsoft Teams chats to impersonate IT support and persuade employees to grant remote access, according to Arctic Wolf Labs. Across hundreds of cases, the company identified recurring use of disposable Microsoft 365 tenants, support-themed identities and legitimate remote-access software, with some intrusions progressing to malware execution and broader compromise.
The activity targets organizations that allow external access in Teams. Arctic Wolf described the technique as an abuse of trust rather than exploitation of a software vulnerability, according to findings reported by The Hacker News.
From inbox flooding to remote access
In many cases, attackers first flood an employee’s inbox with hundreds of newsletter or subscription confirmations within a short period. A Teams message then arrives offering supposed IT assistance, turning the disruption into a pretext for contact.
The messages come from identities established through newly created or acquired Microsoft 365 tenants. Attackers use names such as “Help Desk,” “IT Support” and “Enterprise IT & Security (Internal)” to make external accounts appear familiar despite Teams’ external-user warnings. More recently, Arctic Wolf observed attackers adding the target organization’s name or domain to their display names.
Approximately 30–40% of the cases Arctic Wolf investigated involved *.onmicrosoft[.]com, the permanent fallback domain Microsoft automatically generates when a tenant is created. Observed examples included helpdeskteam365.onmicrosoft[.]com and itendpoint365.onmicrosoft[.]com.
Arctic Wolf also reported a recent shift toward paid domains. Among paid domains identified in these scams over the preceding few months, approximately 50% of fake identities used .top, around 40% used .com, and just over 5% used multi-level domains such as .com.pl, .com.vn and .com.br.
Voice-based social engineering helps move the victim from chat to granting hands-on access through legitimate tools. Those observed included Quick Assist, AnyDesk, ScreenConnect (ConnectWise), TeamViewer, Atera, Zoho Assist, NetSupport and LogMeIn.
What the remote session enables
Once connected, attackers can use the remote session for reconnaissance, additional payload delivery and lateral movement. The reported activity included deployment of the GoGRPC backdoor, movement toward domain controllers and installation of Level as an additional remote-access tool for redundancy. Some intrusions progressed to sensitive-data exfiltration and ransomware deployment.
The report described similarities with activity tracked as STAC4749, which has used IT-themed .top cloud domains and plausible employee usernames. Sophos has linked attacks associated with that activity to Chaos ransomware deployment; the comparison does not establish that every Teams impersonation case involved the same operator or ransomware family.
One case followed a distinct execution chain. The attacker instructed a user to run a PowerShell command that downloaded and launched an MSI installer from Microsoft Azure Blob Storage. The installer started a PowerShell script that extracted and executed an embedded Python implant. That backdoor initiated another MSI transaction, queried Active Directory through LDAP for all computer and user objects, and transmitted the results to an external server.
Arctic Wolf said attackers generally avoid placing payload URLs directly in Teams, where Safe Links / ZAP scanning could inspect them. Instead, they navigate to the payload during the remote session. That behavior makes endpoint and identity telemetry essential monitoring sources alongside message scanning, the company said.
