Arctic Wolf has documented more than 400 incidents where attackers used Microsoft Teams external chat to pose as internal IT support and talk employees into handing over their machines. Nothing in the chain depends on a software flaw.

What happened

The pattern repeats almost exactly across cases. The victim's inbox is flooded with hundreds of newsletter and subscription confirmations within minutes, then a Teams message arrives from an account called something like "IT Support (Internal)" or "IT Service Desk (Liam)", offering to fix the mess the attacker just created.

Between 30 and 40 percent of the fake identities sat on default onmicrosoft.com tenant domains, which need no verification and take minutes to create. Of the paid domains observed, roughly half used the .top extension. Once the employee engaged, researchers saw payload execution in under 15 minutes in cases their customers reported.

The remote access itself came from legitimate tools: Quick Assist most often, then AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport and LogMeIn. Attackers avoided pasting links into chat to dodge Safe Links, instead navigating to the payload themselves during the session, then installing a second commercial RMM tool for access that survives cleanup. The described chain installed a Python implant that queried Active Directory over LDAP for user and computer objects and sent the results out, on the way to ransomware.

Who is affected

• Any Microsoft 365 tenant that allows Teams chats from external tenants, which is the default
• Staff who would accept an unsolicited support message from someone with a plausible name
• Organisations running Windows endpoints with Quick Assist available to every user

What to do now

Turn Teams external access into an allow-list of partner domains, and tell staff that IT will never open a support chat from outside the company.

• Review the Teams external access setting and restrict it to domains you actually work with
• Restrict Quick Assist to IT roles through Intune or Group Policy, and remove it where nobody uses it
• Block unsanctioned RMM tools with application control; allow only the remote support product your helpdesk uses
• Alert on the sequence: new external Teams chat, then Quick Assist or an RMM binary on the same machine, then PowerShell making web downloads
• Give staff one verified support channel and a callback number to use instead of replying to the chat

What this means for South African businesses

This is the most directly relevant threat in this batch for a local SME, because every element of the chain is something a small business has switched on by default and has never revisited. The mail bombing is the tell, and it is cheap to detect if anyone is watching mailbox volume. My judgement is that most South African tenants running Microsoft 365 have external Teams access wide open and no rule correlating a new external chat with a Quick Assist session, which means the first warning would be the malware, not the message.

Source: The Hacker News - Teams IT support scams deploy malware and ransomware

Also on the blog

• Rand Mutual investigates claimed 366GB claims data theft, 5 November leak deadline
• Microsoft Authenticator CVE-2026-80097: any Android app could pull your work tokens

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.