Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
Attackers abuse Microsoft Teams external chat to impersonate IT support and deploy malware and ransomware.
Cybersecurity researchers have identified a widespread social engineering campaign where threat actors use Microsoft Teams' external chat feature to impersonate IT support staff and trick users into granting remote access. Attackers create throwaway Microsoft 365 tenants with spoofed IT-themed display names, often preceded by mail bombing to create urgency, then use legitimate RMM tools to deliver malware including Chaos ransomware, GoGRPC backdoors, and conduct lateral movement. The campaign targets organizations with external access enabled and exhibits consistent patterns in domain naming (*.onmicrosoft.com fallback domains and increasingly .top TLDs), display names, and payload delivery methods.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft Teams?
Get an email when a new story names Microsoft Teams, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThreat actors are exploiting Microsoft Teams' external chat functionality to impersonate IT support personnel, first overwhelming users with mail bombs to manufacture urgency, then convincing them to grant remote access via legitimate RMM tools. Because the attackers use real Microsoft 365 tenants with convincing IT-themed display names, users have little technical signal to distinguish the scam from genuine helpdesk contact. Once remote access is granted, attackers deploy ransomware, backdoors, and conduct lateral movement — all under the cover of trusted software. This campaign highlights how social engineering can completely bypass technical controls when users are not trained to verify identity through out-of-band channels. The widespread enablement of external Teams access without compensating controls creates a large, exploitable attack surface.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — helpdeskteam365.onmicrosoft.com
- domain — itendpoint365.onmicrosoft.com
- domain — itcoreportal.onmicrosoft.com
- domain — itadmin922.onmicrosoft.com
- domain — corporateitservicellc.onmicrosoft.com
- malware — Chaos ransomware
- malware — GoGRPC backdoor