Attackers Abuse Microsoft Teams via Email Flooding and Impersonation

En bref

• Attackers are targeting Microsoft Teams to obtain unauthorized access at several organizations.
• Tactics include flooding inboxes, posing as trusted parties, and misusing external chat features.
• Actors also prepare domain infrastructure to support impersonation and chat abuse.
• No CVE is associated; this is abuse of legitimate features and social engineering.
• Severity is medium, but IT admins should tighten Teams external access and monitor anomalies.

Microsoft Teams is being used as an entry point by threat actors who seek unauthorized access at several organizations. According to the available facts, the activity combines inbox flooding, identity deception, misuse of external chat, and setup of domain infrastructure. No software vulnerability or CVE is tied to the campaign; the attackers appear to rely on legitimate collaboration features and social engineering rather than a code flaw.

Affected parties span more than one organization, which suggests a repeatable playbook rather than a single targeted incident. Email bombing can bury security alerts and distract help desk staff, while impersonation and external chat abuse can persuade users to approve access or share information. Domain infrastructure setup gives the actors plausible-looking identities and destinations for their messages.

For K-12 and government IT teams, the lesson is that collaboration platforms need the same scrutiny as email gateways. Teams external access, guest invitations, and chat permissions can become paths for unauthorized entry when governance is loose. Because no CVE exists, patching alone will not close the gap; configuration, monitoring, and user reporting matter more.

Watch for spikes in inbound email volume, new external domains contacting staff, unusual guest activity, and chat requests that pressure users to act quickly. Treat reports of suspicious Teams messages as security events, not just user mistakes. The severity is medium, but the combination of impersonation and external chat abuse can escalate if credentials or meeting links are exposed.

À faire maintenant

1. Restrict Teams external access and guest invitations to approved domains; review existing external chat permissions now.
2. Enable and tune alerting for unusual guest creation, external chat volume, and sign-in anomalies in Teams and Microsoft 365.
3. Harden email filtering and rate-limit inbound mail to reduce email-bombing distractions; ensure security alerts go to a separate channel.
4. Brief help desk and staff on impersonation via Teams and require out-of-band verification for access or credential requests.
5. Register and monitor lookalike domains; block newly observed domains tied to suspicious chat requests.
6. Review Teams audit logs and revoke suspicious guest accounts or external participants; reset credentials if compromise is suspected.
7. Document an incident response playbook for collaboration-platform abuse and test the user reporting workflow.

Source originale

Dark Reading