Microsoft Teams Impersonation Scams Deploy Malware via IT Support Ploys

"A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same 'IT Support (Internal)' display names, the same remote-access tools, and increasingly, the same payload domains," Arctic Wolf Labs said.

How attackers are weaponizing Microsoft Teams external chat

Cybersecurity researchers at Arctic Wolf Labs describe a recurring social-engineering pattern that uses Microsoft Teams' external chat creation feature as an initial-access vector. The accounts used to initiate contact are established through newly created or acquired Microsoft 365 tenants and often employ IT-themed display names or familiar first names to subvert external-user warnings. Arctic Wolf says this pattern has appeared in "hundreds" of cases.

Nearly 30–40% of the incidents the company investigated involved the use of *.onmicrosoft[.]com, a "permanent fallback domain automatically generated by Microsoft when a Microsoft 365 tenant is created." Attackers choose help-desk style tenant names such as helpdeskteam365.onmicrosoft[.]com, itendpoint365.onmicrosoft[.]com, and itcoreportal.onmicrosoft[.]com to increase credibility.

Mail bombing, display names, and shifting domain choices

The Teams engagement is commonly preceded by mail bombing — an automated flood of newsletter or subscription confirmations — intended to create urgency and distract the target. Shortly thereafter, an external Teams message appears, purporting to be IT support. Arctic Wolf cataloged recurring display names used in these lures, including:

• Help Desk
• IT Support
• HelpDesk Manager
• IT Service Desk – Liam / IT Service Desk (Liam)
• IT Support – Christopher Thomas
• Enterprise IT & Security (Internal)
• Business IT Solutions & Support (Internal)

Attackers have also begun appending the target organization's domain or company name to their display names to lend additional legitimacy. Arctic Wolf additionally notes a shift toward paid top-level domains for tenant creation: approximately 50% of fake identities used the .top TLD, about 40% used a standard .com, and just over five percent used multi-level domains such as .com.pl, .com.vn, and .com.br.

From remote support to full compromise: RMM tools, payloads, and ransomware

The adversary playbook moves victims from chat to hands-on-keyboard access using remote monitoring and management (RMM) tools. Arctic Wolf lists Quick Assist, AnyDesk, ScreenConnect (ConnectWise), TeamViewer, Atera, Zoho Assist, NetSupport, and LogMeIn among the services abused. During remote sessions, attackers perform reconnaissance, deliver secondary payloads, and deploy additional RMM tooling for persistence and redundancy — Arctic Wolf cites "Level" as an example.

Payloads and follow-on activity observed include a GoGRPC backdoor and, in some incidents, deployment of Chaos ransomware. Sophos has attributed earlier activity to a group tracked as STAC4749, which has a history of creating IT-themed cloud domains under the .top TLD and using plausible employee usernames to impersonate staff. In at least one reported case, the attacker instructed the user to run a PowerShell command that downloaded an MSI installer from Microsoft Azure Blob Storage; the MSI unpacked and executed a Python implant, issued LDAP queries to Active Directory, and transmitted the harvested data to an external server.

Detection challenges: Safe Links, notes, and the limits of message scanning

Arctic Wolf warns that attackers generally avoid pasting URLs into Teams messages because that would trigger Safe Links / ZAP scanning. Instead, they navigate to payloads during a live remote session or use Microsoft Notes as a staging area. The vendor recommends that "endpoint and identity telemetry are essential monitoring surfaces alongside message scanning" because the attack exploits trust and interaction rather than a software vulnerability. In short, conventional message filtering alone can be insufficient when an attacker convinces a user to grant remote access.

What this means for technologists, affected enterprises, and end users

• Technologists and security teams: Watch for sudden inbox floods (mail bombing) followed by external Teams contact and monitor endpoint and identity telemetry during external chats. Track new tenant names and the rise in .top and unusual paid domains tied to support-themed identities.
• Affected enterprises and procurement leaders: Review where external access is enabled, log and audit the use of RMM tools, and be alert to unexpected remote sessions that originate from recently created cloud tenants or onmicrosoft fallback domains.
• End users and general staff: Be skeptical of unsolicited Teams messages claiming to be IT support even when a familiar name or company identifier appears; attackers frequently rely on familiar display names and social pressure created by mail bombing to prompt quick action.

Arctic Wolf's core observation is blunt: "External Microsoft Teams chat has become an effective initial-access vector because it exploits trust rather than a software vulnerability." The documented pattern — throwaway tenants, help-desk personas, remote-access tooling, and a shift toward paid TLDs — turns a collaboration platform into a path for reconnaissance, data exfiltration, and ransomware. The open question for defenders is practical and immediate: how to pair message controls with the endpoint and identity telemetry Arctic Wolf describes, so that a routine chat does not become the opening scene of a much larger compromise.

Original story at The Hacker News