Security researchers have identified a recurring social engineering pattern in which threat actors leverage Microsoft Teams' external chat creation feature to conduct impersonation scams and deliver malware or ransomware. The attacks involve the use of throwaway tenants and fake IT support identities to appear legitimate, targeting Microsoft Teams users globally. While the exact number of cases and specific threat actor groups remain unconfirmed, hundreds of incidents have been documented.

What should defenders do?

Microsoft should improve verification for external contacts within Teams. Users must verify IT support identities through official channels before engaging. Exercise caution with unsolicited Teams contacts. Report suspicious activity to Microsoft.

highCyber Attacks

Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware

Threat actors exploit external chat creation feature using throwaway tenants and fake IT identities

Cyber.TechVoidPublished about 2 hours agoUpdated less than a minute ago1 min read

Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware

Key Takeaways

Threat actors are using Microsoft Teams' external chat feature to conduct impersonation scams and deliver malware/ransomware.
Attacks involve the use of throwaway tenants and fake IT support identities to appear legitimate.
Hundreds of cases have been documented, though exact victim counts and specific threat actor groups remain unconfirmed.

Related Security News

highvulnerability

Multiple Critical RCE Vulnerabilities and Supply-Chain Incident Reported in Weekly Recap

A weekly cybersecurity recap highlights the emergence of multiple critical remote code execution vulnerabilities across various platforms, with active scanning and exploitation observed. Additionally, a software supply-chain incident was reported following the leakage of a signing key, raising compromise risks for downstream users.

The Hacker News32 minutes ago1 min read