Attackers Abuse Teams External Chats to Impersonate IT and Deliver Malware

En bref

• Hundreds of incidents involve external Teams chats.
• Attackers pose as IT support from disposable tenants.
• Payloads include malware and ransomware.
• No software vulnerability is required.

Criminal actors are turning to Microsoft Teams to create external chats and pose as internal IT helpdesk staff. They set up temporary tenants so the conversation appears to come from a legitimate support organization. Hundreds of incidents have been observed, and the activity does not rely on a software flaw or CVE.

Organizations that allow external collaboration in Teams are the primary targets. After establishing trust, the attacker may send links, files, or instructions that lead to malware installation and, in some cases, ransomware. The same pattern is also used for impersonation scams that seek credentials or other sensitive information.

This matters because the abuse rides on a trusted collaboration platform rather than email. Disposable tenants lower the barrier to entry, and IT support impersonation is especially convincing for staff who expect helpdesk contact. Because no vulnerability is involved, patching alone will not stop the activity.

In K-12 and government settings, Teams is widely used for daily operations, making unexpected external chats a realistic risk. Watch for new or unfamiliar tenant domains, unsolicited support offers, and requests to move to another channel or open an attachment. Review audit logs for external chat creation and user reports of suspicious conversations.

Security teams should treat this as a social-engineering and access-control issue. The key controls are limiting external collaboration, blocking untrusted tenants, and giving users a clear way to verify IT support requests through known internal channels.

À faire maintenant

1. Restrict or disable external Teams chat for users who do not need it, and allow only approved partner domains.
2. Maintain tenant allow and block lists, and block disposable or newly observed domains used in impersonation attempts.
3. Require staff to verify IT support requests through a known internal phone number or service portal before acting.
4. Train users to report unsolicited external chats and never open unexpected attachments or links.
5. Monitor Teams audit logs for external chat creation, unfamiliar tenant activity, and impersonation patterns.
6. Enforce MFA and conditional access, and review helpdesk procedures for credential and remote-access requests.
7. Test ransomware response plans and ensure reported chats are escalated quickly to security operations.

Source originale

The Hacker News