Arctic Wolf observed over 400 incidents in which attackers abused Microsoft Teams’ external chat creation feature, and in many cases achieved payload execution in under 15 minutes from a victim’s first interaction, the company reported on October 26, 2026.
How attackers set up convincing Teams identities
The Arctic Wolf researchers found that threat actors leveraged Microsoft 365 tenants—often newly created or acquired—to establish external Teams identities that looked legitimate to targets. Teams’ external access is turned on by default, allowing any Teams user in another Microsoft 365 tenant to find, chat with, and call an organization’s employees so long as both tenants permit external access.
Between 30–40% of the observed cases used default onmicrosoft[.]com tenant domains, which, Arctic Wolf notes, do not require verification and can be provisioned within minutes. Attackers typically chose tenant names containing support-, IT-, admin-, network-, or helpdesk-themed words, sometimes suffixed with “365,” and used display names such as “IT Service Desk – Liam” to simulate an internal service-desk presence. In a smaller number of incidents, legitimate company names were included in the sender’s tenant name to increase credibility.
Email bombing, rapid social engineering, and automation
Arctic Wolf documented a rapid, multi-step social-engineering chain. In a “significant number” of attacks targets’ email inboxes were flooded with hundreds of newsletter or subscription confirmations within minutes—a tactic the report identifies as mail bombing. Moments after the mail bombing, the attackers sent an “IT support” Teams message offering to resolve the very problem they had just created.
The attack timeline was fast: payload execution was often reached in under 15 minutes from the initial social-engineering message. Attackers also targeted multiple victims within short windows of time, a pattern the researchers say suggests the use of automation. Arctic Wolf summarized the pattern this way: “Across the activity examined, attackers combined email bombing, convincing IT-support impersonation, newly created tenants and domains, and rapid social engineering to move victims from a seemingly routine chat to remote access, payload execution, and, in some cases, broader compromise.”
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadFrom Quick Assist to commercial RMM and PowerShell payloads
Once in conversation with a victim, the attackers’ primary immediate objective was hands-on-keyboard access using legitimate remote monitoring and management (RMM) tools. Arctic Wolf found Quick Assist—the tool built into Windows that requires no installation—was the most frequently used initial RMM. When attackers wanted persistence beyond the initial session, they pivoted to commercial RMM tools such as AnyDesk and ScreenConnect.
Those RMM connections enabled attackers to execute a PowerShell payload and undertake lateral movement across an organization’s network for purposes such as ransomware. In some cases users were instructed to run a PowerShell command and to launch a downloaded file.
Recommendations within Teams admin controls and user behavior
Arctic Wolf details actionable defender steps that live largely inside the Teams admin center and in endpoint policy. Key recommendations include:
- In Teams admin center → Users → External access, select ‘Allow only specific external domains’ and add only the partner domains the organization actively collaborates with.
- Block chat with unmanaged / Teams-consumer accounts, and disable the option that lets unmanaged users start conversations with your users.
- Block federation with trial-only tenants, as attackers commonly prefer free or trial tenants for their minimal setup requirements.
- Enable ‘Allow my security team to manage blocked domains’ so the security team can push blocks.
- Block or restrict Quick Assist to authorized IT roles and block or uninstall unsanctioned RMM tools.
- Educate staff on how to detect these threats, including detailing exactly how real IT support reaches out and training users to read the External tag and the real sender domain.
- Make employees aware of Microsoft’s end-user reporting for security tool in Teams, which allows employees to report a suspicious message or an external user with a couple of clicks.
What this means for technologists, end users, and procurement
Technologists and security teams should prioritize Teams admin controls and RMM restrictions called out above, since Arctic Wolf’s findings place the initial access vector squarely in default tenant and federation behaviors. End users must be trained to recognize the “External” tag, scrutinize sender domains, and use the built-in reporting tool—because the attack sequence relies on fast, routine-seeming interactions that can convert into remote access in minutes. Procurement and IT asset owners should inventory and restrict unsanctioned RMM tools, given the report’s finding that attackers pivot from Quick Assist to commercial RMM solutions like AnyDesk and ScreenConnect when seeking persistence.
Arctic Wolf did not identify the perpetrators behind these incidents, but noted that use of external Teams chat as an initial access vector has been a tactic deployed by ransomware groups including Black Basta. The finding is a clear signal: default convenience features and trial tenants can be weaponized into a multi-stage, ultra-fast intrusion. Organizations that leave external access open, allow unmanaged tenants to initiate conversations, or fail to control RMM tools are the same ones Arctic Wolf’s report shows can be moved from a casual chat to remote access—and sometimes broader compromise—within a matter of minutes.
Source: https://www.infosecurity-magazine.com/news/exploit-teams-chat-breach/
