Attackers Exploit Teams External Chat to Breach Organizations in Under 15 Minutes

Threat actors are abusing Microsoft Teams’ external chat creation feature to target employees for initial access into organizations, new research by Arctic Wolf has found.

The researchers said they had observed over 400 incidents in which the function was abused, with “highly consistent” IT-support impersonation tactics deployed by the malicious actors.

The attack chain is rapid, with payload execution reached in under 15 minutes from when a victim engages with the initial social engineering message.

The attackers often target multiple victims within short windows of time, which suggests the use of automation.

“Across the activity examined, attackers combined email bombing, convincing IT-support impersonation, newly created tenants and domains, and rapid social engineering to move victims from a seemingly routine chat to remote access, payload execution, and, in some cases, broader compromise,” the Arctic Wolf researchers wrote in the report published on October 26, 2026.

The researchers did not identify the perpetrators behind these attacks. However, it noted that the use of the external Teams chat as an initial access vector has been a tactic deployed by ransomware groups including Black Basta.

Threat Actors Establish Legitimate-Looking Teams Identities

Arctic Wolf noted that the external Microsoft Teams chat function has become an effective platform to launch social engineering, with attackers able to make themselves appear legitimate to users.

Teams’ external access is turned on by default, meaning any Teams user in another Microsoft 365 tenant can find, chat with, and call an organization’s employees, provided both tenants allow external access.

In the observed incidents, the threat actors established external Teams identities through newly created or acquired Microsoft 365 tenants. Between 30-40% of the cases involved default onmicrosoft[.]com tenant domains, which do not require verification and can be provisioned within minutes.

The attackers typically selected a support-, IT-, admin-, network-, or helpdesk-themed word as the tenant name, optionally suffixed with the number 365, to appear as an IT-support worker.

In addition, threat actors used fake first names, such as “IT Service Desk – Liam”, to make it appear as though the message came from a real member of the organization’s service desk.

In a small number of cases, legitimate company names were included in the sender’s tenant name to increase their credibility.

In a “significant number” of the attacks the target’s email was flooded with hundreds of newsletter or subscription confirmations within minutes, a tactic known as mail bombing.

The attackers then sent a Teams “IT support” message moments later to offer to resolve the very same problem the attacker just created.

Following the initial contact, the attackers’ next aim in most cases was to obtain hands-on-keyboard access through legitimate remote monitoring and management (RMM) tools, most frequently Quick Assist, which is built into Windows and therefore requires no installation.

When attackers seek persistence beyond the initial call, they pivot to a commercial RMM tool, such as AnyDesk and ScreenConnect.

These RMM tools can enable to attackers to execute a PowerShell payload and undertake lateral movement across the organizations network for purposes such as ransomware.

In some cases, the user was instructed to run the PowerShell command and launch the downloaded file.

How Security Teams Can Protect Against Teams’ Attacks

The Arctic Wolf researchers set out a number of recommendations for defenders to protect against the use of the external Teams chat function for initial access. These include:

• In Teams admin center → Users → External access, select ‘Allow only specific external domains’ and add only the partner domains the organization actively collaborates with
• Block chat with unmanaged / Teams-consumer accounts, and disable the option that lets unmanaged users start conversations with your users
• Block federation with trial-only tenants, as attackers commonly prefer free or trial tenants for their minimal setup requirements
• Enable ‘Allow my security team to manage blocked domains’ so the security team can push blocks
• Block or restrict Quick Assist to authorized IT roles and block or uninstall unsanctioned RMM tools
• Educate staff on how to detect these threats, such as detailing exactly how real IT support reaches out and train users to read the External tag and the real sender domain
• Make employees aware of Microsoft’s end-user reporting for security tool in Teams, which allows employees to report a suspicious message or an external user with a couple of clicks