October 30, 2026, 6:55 am | Read time: 2 minutes
Cybercriminals are exploiting the external chat feature of Microsoft Teams to target company employees. Security researchers at Arctic Wolf have investigated more than 400 cases and identified a recurring pattern. The perpetrators create short-lived Microsoft accounts and pose as internal contacts with names like “IT Support (Internal)” or “IT Service Desk.” Although Teams marks external contacts, they still manage to build trust.
In about 30 to 40 percent of the cases investigated, the attackers used automatically provided onmicrosoft.com domains. However, they are increasingly using paid addresses. The endings .top and .com are particularly common.
How Teams Users Are Deceived
Before the criminals make contact, they bombard their victims with emails. In this so-called mail bombing, numerous newsletter confirmations and subscription messages flood the inbox. Shortly afterward, a supposed IT employee contacts them via Teams and offers assistance. The victims are asked to start a remote maintenance program, such as Quick Assist, AnyDesk, ScreenConnect, or LogMeIn. Once they allow access, the attackers can control the computer remotely.
Subsequently, the perpetrators often secure themselves with a second remote maintenance software. They then search the network for other devices and user accounts to expand their access. In the worst-case scenario, they install malware to spy on data or encrypt files and demand ransom. The attack method is associated with the ransomware group Black Basta.
Measures to Stop Hackers
Arctic Wolf advises companies to restrict external chats in Teams and only allow contacts from trusted organizations. Additionally, they should set up alerts for newly initiated individual chats and block messages from unmanaged accounts. The connection to trial versions of Microsoft 365 environments should also be limited.
Also of interest: Microsoft disables text prediction in Word and Outlook
It is also crucial to make employees aware of such fraud attempts. A message is not automatically trustworthy just because it arrives via a familiar program. Microsoft itself plans to introduce AI-powered phishing detection in Teams in November 2026. It will analyze the context of conversations and warn of suspicious messages, especially during initial contacts with external users.