[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEUvIJFNNwItpfFTpxRWz3dXR1OzaaT7CSaJPY7yDjeI":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"dce5e712-fc26-4566-aecf-658b32cccff0","teams-external-chat-exploited-for-social-engineering-via-inbox-flooding","2ab930f6-a22a-4adf-a239-ebdd7bbfc455","Teams External Chat Exploited for Social Engineering via Inbox Flooding","Attackers exploited Microsoft Teams' default-enabled external messaging feature — a configuration setting many organizations leave untouched — to impersonate IT support staff after overwhelming victims with inbox spam. By flooding inboxes first, threat actors created a convincing pretext for their 'helpful' Teams outreach, bypassing email-based security controls entirely. Victims were then socially engineered into granting remote access via legitimate tools like Quick Assist, meaning no malware or exploits were needed to compromise the endpoint. This attack chain highlights how default platform configurations and insufficient user training can combine to create a highly effective, low-cost intrusion pathway that completes in under 15 minutes.","**Immediate actions:**\n- Disable or restrict Microsoft Teams external access in the admin portal to allow messaging only from trusted\u002Fwhitelisted domains.\n- Block or require approval workflows for remote access tools (e.g., Quick Assist, AnyDesk) via endpoint management policies unless explicitly authorized by IT.\n\n**Security awareness measures:**\n- Train employees to recognize IT impersonation tactics over Teams and establish a verified, out-of-band callback procedure before granting any remote access.\n- Educate staff that sudden inbox spam floods are a known social engineering trigger and should be immediately reported to the security team.\n\n**Detection and response measures:**\n- Configure SIEM or Microsoft Sentinel alerts for anomalous Teams external-contact events combined with remote tool execution on the same endpoint.\n- Establish a clear incident reporting channel so employees can quickly validate whether an IT support contact is legitimate before taking any action.",[12,13,14,15,16,17,18],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","MITRE ATT&CK T1566: Phishing","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1566: Phishing":21,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":22,"CIS Control 17: Incident Response Management":23,"CIS Control 14: Security Awareness and Skills Training":24,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires appropriate technical and organisational measures including incident handling and awareness; the absence of both a restrictive Teams configuration and staff training represents a failure of these baseline security obligations.","This attack is a direct instance of spear-phishing via a collaboration service, where the Teams platform served as the phishing channel after email defenses were bypassed by the inbox-flooding tactic.","Employees lacked the competence to identify social engineering delivered through a trusted internal-seeming tool, underscoring the need for role-specific security training on collaboration platform risks.","A practiced incident response process with a verified IT-contact procedure would have given employees a clear escalation path to confirm legitimacy before granting remote access.","Victims were successfully socially engineered into installing remote access tools, demonstrating that employees lacked training on IT impersonation tactics and how to verify support requests.","Microsoft Teams' default-enabled external chat feature was left in its out-of-the-box state; hardening this setting by restricting external messaging would have removed the primary attack vector.","Attackers succeeded by spoofing IT identities within Teams; enforcing verified identity controls and restricting who can initiate privileged support sessions would have prevented impersonation.","published","2026-10-27T15:21:28.758891+00:00","2026-10-27T15:21:28.736+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F10\u002F27\u002Fmicrosoft-teams-social-engineering-fake-it-help-desk\u002F","hackers-bury-inboxes-in-spam-then-show-up-on-microsoft-teams-posing-as-it-suppor-963478","Hackers bury inboxes in spam then show up on Microsoft Teams posing as IT support",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":42,"name":43,"slug":44,"description":45,"color":46},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[49,53,57],{"slug":50,"name":51,"problem":52},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":54,"name":55,"problem":56},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":58,"name":59,"problem":60},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]