Hackers are exploiting Microsoft Teams' external chat feature to impersonate IT support staff, tricking employees into running malicious PowerShell commands This article explores hackers exploiting microsoft. . Arctic Wolf Labs analyzed over 400 incidents, revealing the repeated use of fake support identities, disposable Microsoft 365 tenants, remote access tools, and shared infrastructure.
Many attacks start with email flooding, sending out subscription messages. The sender’s display name, like “IT Support (Internal),” tries to deceive, while Teams labels the sender as external.
In one infection chain, an attacker posing as a helpdesk employee instructed a victim to run a PowerShell command and open the downloaded file. The observed Teams-based attack chain began with an initial external "ChatCreated" contact, followed by vishing, and concluded with Quick Assist/RMM installation leading to payload execution (Source: ArcticWolf). It then initiated another MSI transaction that queried Active Directory for computer and user objects using LDAP and the adsisearcher shortcut.
Collected account names and descriptions were sent to randomly chosen command-and-control endpoints from embedded lists within the implant. Among the observed paid-domain identities, about half used .top domains, while around 40 percent used arcticwolf identities. Security teams should correlate suspicious external chats with inbox flooding, unexpected remote access software, PowerShell execution, and identity alerts.
Join 16,000+ SOC teams using ANY.RUN to enhance threat investigations and decrease manual workload.
