[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4CT09hBc79LO2j2dwl2AMOostA2-0f0GMzMK4pYh8hw":3},{"article":4,"iocs":46,"watch_terms":57,"solutions":58,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"2ab930f6-a22a-4adf-a239-ebdd7bbfc455","Hackers bury inboxes in spam then show up on Microsoft Teams posing as IT support","hackers-bury-inboxes-in-spam-then-show-up-on-microsoft-teams-posing-as-it-suppor-963478","Threat actors are flooding employees’ inboxes with spam and then contacting them on Microsoft Teams as IT support, offering to fix the problem they created, Arctic Wolf has found. The security company documented more than 400 incidents in which the external chat feature in Teams was abused. In many of these cases, the fake help desk message arrived minutes after the victim’s inbox had been filled with hundreds of newsletter and subscription confirmations. “Microsoft Teams … More → The post Hackers bury inboxes in spam then show up on Microsoft Teams posing as IT support appeared first on Help Net Security.","Arctic Wolf documented over 400 incidents where attackers exploited Microsoft Teams' default-enabled external chat feature to conduct social engineering attacks. Threat actors first spam employee inboxes with hundreds of confirmations, then contact victims posing as IT support via Teams using spoofed identities, ultimately tricking them into installing remote access tools like Quick Assist. The attacks succeed within 15 minutes and bypass email-based defenses by operating within the trusted Teams environment.","Threat actors flood inboxes with spam then impersonate IT support on Microsoft Teams to gain remote access.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F10\u002F27\u002Fmicrosoft-teams-social-engineering-fake-it-help-desk\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2023\u002F07\u002F10152152\u002Fms-teams3.jpg","2026-10-27T14:16:43+00:00","2026-10-27T15:00:20.130979+00:00",8,[17,20,23,25,28],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Microsoft Teams","product",{"name":24,"type":19},"Arctic Wolf",{"name":26,"type":27},"Chaos ransomware","campaign",{"name":29,"type":19},"Sophos","2c8f44d4-b56e-47cf-9677-04f22c9ee78d",{"id":30,"icon":32,"name":33,"slug":34},null,"Identity & Access","identity-access",[36,41],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,51,54],{"type":48,"value":49,"context":50},"malware","Quick Assist","Legitimate Windows tool abused by attackers to gain remote access after social engineering via Teams",{"type":48,"value":52,"context":53},"AnyDesk","Commercial remote access tool used as secondary persistence mechanism in attacks",{"type":48,"value":55,"context":56},"ScreenConnect","Commercial remote access tool deployed during Teams-based social engineering attacks",[18,24,29],{"controls":59,"vendors":141},[60,89,118],{"slug":61,"name":62,"problem":63,"products":64},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":90,"name":91,"problem":92,"products":93},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"slug":119,"name":120,"problem":121,"products":122},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[123,129,134],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":124,"product_name":125,"url":127,"description":128},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":130,"product_name":131,"url":132,"description":133},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":119,"product_name":138,"url":139,"description":140},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[142,147],{"slug":143,"name":24,"logo_path":144,"roles":145},"arctic-wolf","\u002Fvendor-logos\u002Farctic-wolf.png",[146],"reported_by",{"slug":148,"name":18,"logo_path":149,"roles":150},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[151],"affected",{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":164},"teams-external-chat-exploited-for-social-engineering-via-inbox-flooding","Teams External Chat Exploited for Social Engineering via Inbox Flooding","Attackers exploited Microsoft Teams' default-enabled external messaging feature — a configuration setting many organizations leave untouched — to impersonate IT support staff after overwhelming victims with inbox spam. By flooding inboxes first, threat actors created a convincing pretext for their 'helpful' Teams outreach, bypassing email-based security controls entirely. Victims were then socially engineered into granting remote access via legitimate tools like Quick Assist, meaning no malware or exploits were needed to compromise the endpoint. This attack chain highlights how default platform configurations and insufficient user training can combine to create a highly effective, low-cost intrusion pathway that completes in under 15 minutes.",[157,158,159,160,161,162,163],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","MITRE ATT&CK T1566: Phishing","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":165,"MITRE ATT&CK T1566: Phishing":166,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":167,"CIS Control 17: Incident Response Management":168,"CIS Control 14: Security Awareness and Skills Training":169,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":170,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":171},"NIS2 requires appropriate technical and organisational measures including incident handling and awareness; the absence of both a restrictive Teams configuration and staff training represents a failure of these baseline security obligations.","This attack is a direct instance of spear-phishing via a collaboration service, where the Teams platform served as the phishing channel after email defenses were bypassed by the inbox-flooding tactic.","Employees lacked the competence to identify social engineering delivered through a trusted internal-seeming tool, underscoring the need for role-specific security training on collaboration platform risks.","A practiced incident response process with a verified IT-contact procedure would have given employees a clear escalation path to confirm legitimacy before granting remote access.","Victims were successfully socially engineered into installing remote access tools, demonstrating that employees lacked training on IT impersonation tactics and how to verify support requests.","Microsoft Teams' default-enabled external chat feature was left in its out-of-the-box state; hardening this setting by restricting external messaging would have removed the primary attack vector.","Attackers succeeded by spoofing IT identities within Teams; enforcing verified identity controls and restricting who can initiate privileged support sessions would have prevented impersonation."]