Hackers bury inboxes in spam then show up on Microsoft Teams posing as IT support
Threat actors flood inboxes with spam then impersonate IT support on Microsoft Teams to gain remote access.
Arctic Wolf documented over 400 incidents where attackers exploited Microsoft Teams' default-enabled external chat feature to conduct social engineering attacks. Threat actors first spam employee inboxes with hundreds of confirmations, then contact victims posing as IT support via Teams using spoofed identities, ultimately tricking them into installing remote access tools like Quick Assist. The attacks succeed within 15 minutes and bypass email-based defenses by operating within the trusted Teams environment.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers exploited Microsoft Teams' default-enabled external messaging feature — a configuration setting many organizations leave untouched — to impersonate IT support staff after overwhelming victims with inbox spam. By flooding inboxes first, threat actors created a convincing pretext for their 'helpful' Teams outreach, bypassing email-based security controls entirely. Victims were then socially engineered into granting remote access via legitimate tools like Quick Assist, meaning no malware or exploits were needed to compromise the endpoint. This attack chain highlights how default platform configurations and insufficient user training can combine to create a highly effective, low-cost intrusion pathway that completes in under 15 minutes.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Quick Assist
- malware — AnyDesk
- malware — ScreenConnect