[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f862gQNkEmcj-h6YpzdBf7QZ6RL_EyWqHzROcz0JUam8":3},{"article":4,"iocs":50,"watch_terms":81,"solutions":82,"lesson":177},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"2321d3f8-c171-4107-ab82-02881b6f1164","Hackers Abuse Microsoft Teams External Chats to Access Corporate PCs","hackers-abuse-microsoft-teams-external-chats-to-access-corporate-pcs-633420","Hackers impersonate IT support in Microsoft Teams external chats, tricking employees into granting remote access and installing malware on corporate computers.","Cybersecurity researchers have identified a campaign where attackers impersonate IT support in Microsoft Teams external chats to trick employees into granting remote access. This technique leverages the default external chat feature and often follows a 'mail bombing' tactic to create urgency, leading to the installation of malware and implants that exfiltrate corporate network data.","Hackers exploit Microsoft Teams external chat settings to gain remote access to corporate PCs.","https:\u002F\u002Fhackread.com\u002Fhackers-abuse-microsoft-teams-external-chats-pc\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002Fhackers-abuse-microsoft-teams-external-chats-pc.jpg","2026-10-27T14:43:40+00:00","2026-10-27T15:00:17.278229+00:00",8,[17,20,22,24,26,29],{"name":18,"type":19},"Microsoft Teams","product",{"name":21,"type":19},"Quick Assist",{"name":23,"type":19},"AnyDesk",{"name":25,"type":19},"TeamViewer",{"name":27,"type":28},"Active Directory","technology",{"name":30,"type":31},"Microsoft","vendor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},[51,55,58,61,64,67,70,73,76,79],{"type":52,"value":53,"context":54},"mitre_attack","T1219","Remote Access Software",{"type":47,"value":56,"context":57},"Python-based implant","Malware used to query Active Directory and exfiltrate data.",{"type":52,"value":59,"context":60},"T1059.001","PowerShell",{"type":52,"value":62,"context":63},"T1071.001","Web Protocols (HTTP\u002FHTTPS)",{"type":52,"value":65,"context":66},"T1190","Exploit Public-Facing Application",{"type":52,"value":68,"context":69},"T1566.002","Spearphishing Link",{"type":52,"value":71,"context":72},"T1566.001","Spearphishing Attachment",{"type":52,"value":74,"context":75},"T1003","OS Credential Dumping",{"type":52,"value":77,"context":78},"T1087.002","Local Accounts",{"type":52,"value":80,"context":78},"T1087.001",[30,18,21],{"controls":83,"vendors":167},[84,113,141],{"slug":85,"name":86,"problem":87,"products":88},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":114,"name":115,"problem":116,"products":117},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":135,"vendor_name":30,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"slug":142,"name":143,"problem":144,"products":145},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[146,152,160],{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":147,"product_name":148,"url":150,"description":151},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":153,"vendor_name":154,"vendor_logo":155,"product_slug":156,"product_name":157,"url":158,"description":159},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":161,"vendor_name":162,"vendor_logo":163,"product_slug":161,"product_name":164,"url":165,"description":166},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[168,174],{"slug":169,"name":170,"logo_path":171,"roles":172},"arctic-wolf","Arctic Wolf","\u002Fvendor-logos\u002Farctic-wolf.png",[173],"reported_by",{"slug":135,"name":30,"logo_path":136,"roles":175},[176],"affected",{"slug":178,"title":179,"body":180,"framework_refs":181,"framework_notes":189},"teams-external-chat-impersonation-leads-to-corporate-compromise","Teams External Chat Impersonation Leads to Corporate Compromise","Attackers exploited Microsoft Teams' default external chat functionality to impersonate IT support staff, using social engineering and mail bombing to create a false sense of urgency. Employees were manipulated into granting remote access, which enabled malware installation and data exfiltration from corporate networks. This attack succeeded not because of a software vulnerability, but because default platform settings were left unrestricted and employees lacked the awareness to verify the legitimacy of unsolicited support requests. The combination of an overlooked configuration and insufficient user training created a highly effective attack pathway that bypassed technical controls entirely.",[182,183,184,185,186,187,188],"CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","MITRE ATT&CK T1566: Phishing","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":190,"MITRE ATT&CK T1566: Phishing":191,"NIST SP 800-53 SI-2: Flaw Remediation":192,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":193,"CIS Control 17: Incident Response Management":194,"CIS Control 14: Security Awareness and Skills Training":195,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":196},"NIS2 mandates incident handling and security measures including human risk management; failing to control social engineering risk via collaboration tools and user training is a direct gap in the required organizational security posture.","The attackers used spear-phishing via Teams external chats—a non-email phishing vector—to manipulate employees, directly mapping to this technique and highlighting the need for defenses beyond traditional email-based phishing controls.","While not a software flaw, the misconfigured default Teams external chat setting represents a security gap that should be identified and remediated through systematic configuration reviews aligned with this control.","Organizations are required to ensure personnel are competent in security-relevant matters; staff who could not identify social engineering over Teams demonstrates a gap in required security competence.","A defined incident response process including rapid escalation procedures for suspicious remote access requests would have limited the attacker's ability to persist after initial contact.","Employees lacked the training to recognize impersonation attempts and social engineering over collaboration platforms; structured awareness programs would have equipped staff to challenge and verify unsolicited IT support requests.","The attack hinged on employees failing to verify the identity of the supposed IT support agent; strong identity verification and access control procedures would have prevented unauthorized remote access from being granted."]