Fake IT support on Teams gets staff to allow remote access, Arctic Wolf says

Attackers are posing as IT support in Microsoft Teams chats to talk employees into granting remote access, Arctic Wolf says. They use Teams’ external chat, which is on by default and lets users in other Microsoft 365 tenants message staff. Across more than 400 incidents it analyzed, they used IT-themed tenant and display names. No Teams flaw is involved: the attacks abuse a legitimate feature.

Arctic Wolf says the attackers create or acquire Microsoft 365 tenants with names like help desk or IT support. From 30 to 40% of them use Microsoft’s default onmicrosoft[.]com names. They add “(Internal)” to display names, and lately the target’s company name. Of the paid domains it found in recent months, about half used .top. In many cases, the victim first got hundreds of subscription emails within minutes, then a Teams message or call from “IT support.”

Once a victim engages, the attackers’ aim in most cases is hands-on access through a remote tool, most often Quick Assist. They then install a commercial one like AnyDesk or ScreenConnect to keep control. Customers reported payload execution in under 15 minutes, Arctic Wolf says. In one case, the attacker had the user run a PowerShell command that fetched an installer from Azure Blob Storage. It unpacked a Python implant that queried Active Directory for every user and computer and sent the list to the attacker’s servers.

The technique isn’t new. Microsoft first documented it in mid-2024 in a Black Basta campaign it tracks as Storm-1811, Arctic Wolf notes. The move to .top domains matches Sophos’s reporting on a Chaos ransomware campaign.

When an outside tenant opens a one-on-one chat, Microsoft logs a ChatCreated event. Arctic Wolf says its alerts most often fire there, before the user has done anything.