Microsoft Teams scams involving fake IT support have been identified in more than 400 incidents. Attackers are abusing legitimate external chat features to contact employees, gain remote access and, in some cases, deploy ransomware.
Research published by Arctic Wolf on 26 October 2026 describes a recurring social engineering pattern built around disposable Microsoft 365 tenants and convincing helpdesk personas. Microsoft and Sophos have independently investigated related live campaigns, confirming that this is active exploitation of trust rather than a theoretical risk.
Microsoft Teams scams found across more than 400 incidents
Arctic Wolf analysed more than 400 incidents involving the creation of external Microsoft Teams chats. Attackers created or acquired temporary Microsoft 365 tenants, then contacted employees in other organisations through Teams external access, also known as federation.
The accounts commonly used display names such as “IT Support (Internal)” to appear familiar and undermine the warning that a message came from outside the recipient’s organisation. Researchers repeatedly encountered throwaway .onmicrosoft.com tenants, attacker-controlled domains and paid domains using the .top top-level domain.
The opening message was typically framed as an urgent technical support request. Rather than relying on an obvious malicious attachment, the attacker tried to establish a conversation and persuade the employee that immediate assistance was required.
These Microsoft Teams scams then progressed from text chat into a voice call or remote-assistance session. Attackers frequently directed victims to Microsoft Quick Assist or asked them to install a commercial remote monitoring and management tool. Both types of software have legitimate support uses, helping the request appear credible.
Once the employee approved interactive access, the attacker could run discovery commands, install additional software and inspect the device. This hands-on access also allowed operators to adapt their actions to the target environment instead of depending on a fully automated malware chain.
How fake Teams support becomes a malware intrusion
External contact and remote control
The initial contact does not exploit a Teams software vulnerability. Microsoft Teams external access is enabled by default unless administrators restrict it, allowing users in separate tenants to communicate through chats, calls and meetings.
The activity therefore abuses an intended collaboration workflow. The target sees a contact inside a platform routinely used for workplace communication, while the attacker uses IT terminology, urgency and a support-themed identity to encourage compliance.
After moving the conversation into a call, the attacker may guide the victim through starting Quick Assist and sharing a security code. Alternatively, the user may be told to download an RMM product. Granting either request can provide the operator with direct control over the Windows endpoint.
PowerShell, MSI files and a JavaScript implant
Microsoft documented one technically detailed intrusion path on 2 September 2026. Following Teams-based helpdesk impersonation and remote access, attackers used PowerShell to download and silently install a malicious MSI package.
The package staged a portable Node.js runtime and an obfuscated JavaScript implant. This combination gave the attacker persistent command execution and a channel for communicating with command and control infrastructure without requiring Node.js to have been installed previously.
Operators then performed host and Active Directory reconnaissance to identify users, systems and valuable resources. Microsoft observed lateral movement using Windows Remote Management, including attempts to reach high-value assets such as domain controllers.
Other reported post-compromise actions included using trusted, vendor-signed binaries to make malicious activity less conspicuous. Utilities such as Rclone could also be used to stage and remove stolen data. The resulting objectives have included data theft and ransomware deployment.
Chaos ransomware linked to Teams vishing
Sophos tracked a financially motivated campaign as STAC4749 between February and June 2026. Its investigation connected Teams voice phishing, remote access and subsequent compromise to Chaos ransomware deployment in some incidents.
The finding demonstrates the potential end-to-end impact of Microsoft Teams scams. What begins as an unsolicited support message can lead to interactive access, malware installation, network discovery, data theft and encryption.
Sophos published domains, IP addresses and file hashes associated with the STAC4749 incidents in its STAC4749-Chaos_IOCs_July2026.csv repository entry. Arctic Wolf’s public findings focus more heavily on recurring behavioural indicators, including disposable tenants, IT-themed display names and .top domains.
Timeline of Teams IT support impersonation
The current campaign pattern has precedents dating back several years, although the new Arctic Wolf analysis establishes its scale across more than 400 cases.
-
7 July 2023: The TeamsPhisher proof-of-concept tool was released, demonstrating that files could be delivered from external tenants where relevant controls permitted it.
-
2 August 2023: Microsoft disclosed targeted Teams social engineering by Midnight Blizzard, including credential theft messages and impersonation of technical support personnel.
-
Q3 2023: Security investigations reported DarkGate malware being delivered through Microsoft Teams messages.
-
18 April 2026: Microsoft published a helpdesk impersonation intrusion playbook covering external Teams contact, remote access, hands-on activity and data exfiltration.
-
28 July 2026: Sophos published its STAC4749 research connecting Teams vishing with Chaos ransomware attacks.
-
2 September 2026: Microsoft described the MSI-delivered Node.js and JavaScript implant, along with reconnaissance and lateral movement following Teams impersonation.
-
26 October 2026: Arctic Wolf reported the recurring pattern across more than 400 incidents, with The Hacker News covering the findings on the same date.
Public proof-of-concept tooling has therefore existed since July 2023, but the 2026 incidents do not require TeamsPhisher or exploitation of a code flaw. They rely principally on cross-tenant communication, persuasive social engineering and the victim granting access.
Which Microsoft Teams environments are exposed?
The affected capability is Microsoft Teams external access across desktop and web clients. There is no vulnerable product version or patched CVE associated with these Microsoft Teams scams because attackers are misusing supported federation and remote-support functions.
Windows endpoints are particularly relevant once the conversation progresses to Quick Assist, RMM software, PowerShell and MSI installation. However, any user able to receive an external Teams message may be exposed to the initial impersonation attempt.
Microsoft has also announced changes to external collaboration controls during 2026, including stricter mutual federation options for group chats. Admin trackers have reported a separate file-sharing rollout for external federated chats from late October to late November 2026, making tenant-level review important where administrators want to retain more restrictive settings.
Actions to limit Microsoft Teams scams
Organisations should first establish whether unrestricted external federation is operationally necessary. Because external access is enabled by default, administrators may find that their current exposure reflects a default setting rather than a deliberate business decision.
-
Restrict external access to approved domains where practical, using allow lists or appropriate blocking controls.
-
Review external chat and file-sharing settings before accepting platform defaults or upcoming changes.
-
Tell employees to verify unexpected IT requests through a known internal channel before joining calls, opening files or granting Quick Assist access.
-
Monitor for unusual PowerShell activity, silent MSI installation, portable Node.js execution, new RMM tools and WinRM connections after external Teams contact.
-
Investigate support-themed external accounts, disposable .onmicrosoft.com tenants and unfamiliar .top domains as behavioural warning signs.
Incident responders should correlate Teams, identity and endpoint telemetry rather than treating an external chat as an isolated event. A suspicious support conversation followed by remote-control activity or software installation should be contained promptly, with affected credentials, endpoints and lateral movement reviewed.
Originally reported by thehackernews.com.
