Microsoft Teams scams lead from fake IT chats to ransomware
Microsoft Teams scams are using external chats, fake IT support identities and legitimate remote access software to move from social engineering to malware and, in some cases, ransomware. Arctic Wolf Labs says it has identified the recurring pattern across hundreds of investigated cases, with attackers repeatedly using some of the same disposable Microsoft 365 tenants, support-themed display names, remote access tools and payload domains.
The messages come from identities created through new or acquired Microsoft 365 tenants, which are separate cloud environments set up for organisations. Attackers choose names such as Help Desk, IT Support, HelpDesk Manager, HelpDesk Supervisor, Maintenance Service and IT/Help Desk. Other observed identities included Enterprise IT & Security (Internal), IT Tech Support Internal and IT Service Desk accounts paired with friendly first names. Arctic Wolf says recent attempts have also placed the target's company name or domain in the display name. These choices are intended to make the account look internal despite the warning that Teams shows for an external user.
Around 30 to 40 percent of the cases Arctic Wolf investigated used an address under *.onmicrosoft[.]com. Microsoft automatically creates this permanent fallback domain when a Microsoft 365 tenant is established. Attackers selected support-related tenant names such as helpdeskteam365.onmicrosoft[.]com, itendpoint365.onmicrosoft[.]com, itcoreportal.onmicrosoft[.]com, itadmin922.onmicrosoft[.]com and corporateitservicellc.onmicrosoft[.]com to make the identities resemble corporate IT infrastructure.
Many incidents began with email bombing, in which hundreds of newsletter registrations or subscription confirmations arrived in the victim's inbox within a short period. A fraudulent support message then appeared in Teams and offered to fix the apparent problem. The volume of mail creates urgency and gives the impersonator a timely explanation for making contact. For employees and website operators, an unexpected support chat immediately following an inbox flood should therefore be treated as part of the same possible attack, not as an independent offer of help.
Arctic Wolf also found a shift toward paid top-level domains, or TLDs, which are the endings used by internet domains. Of the paid domains it identified in these scams over the preceding few months, about 50 percent of the fake identities used .top, roughly 40 percent used .com, and just over five percent used multi-level endings including .com.pl, .com.vn and .com.br. The activity is consistent with the cluster tracked as STAC4749, which has previously created IT-themed cloud domains under .top and used plausible employee usernames. Sophos has linked attacks associated with this activity to the deployment of Chaos ransomware, malware that makes data unavailable and demands payment.
The campaigns target organisations that permit external Teams access. Attackers add vishing, meaning voice calls used to deceive someone, and persuade victims to grant interactive control through legitimate remote monitoring and management (RMM) software. Tools observed in the cases include Quick Assist, AnyDesk, ScreenConnect (ConnectWise), TeamViewer, Atera, Zoho Assist, NetSupport and LogMeIn. Because these are real administration products, their presence alone does not establish malicious activity. The danger arises when an unverified caller or chat contact convinces a user to start a session and surrender control.
Once connected, attackers have used that access to inspect the environment, install the GoGRPC backdoor, move between systems and reach domain controllers, which manage identities and access across a Windows network. They have also installed another RMM tool called Level to preserve a second route into the environment. Arctic Wolf says the sequence can progress to the theft of sensitive information and execution of ransomware. The researchers also recorded a subset of cases in which attackers used Microsoft's notes.
Rather than posting a malicious address directly into Teams, attackers generally navigated to the payload themselves after gaining remote control. Arctic Wolf says this avoids placing the address where Microsoft's Safe Links and ZAP message-scanning controls would examine it. That behaviour means message filtering cannot provide the full picture. Organisations also need to review endpoint activity, meaning events on users' computers, and identity activity associated with accounts and access attempts.
In one case, an attacker told the victim to run a PowerShell command, using Microsoft's command and automation tool, to retrieve and open a file. The command downloaded an MSI installer, a Windows software installation package, from Microsoft Azure Blob Storage. Running it started a PowerShell script that extracted and executed an embedded Python implant. That backdoor then initiated another MSI transaction and issued Lightweight Directory Access Protocol (LDAP) queries against Active Directory, collecting every computer and user object before sending the information to an external server.
The incidents exploit trust rather than a software vulnerability, so installing a patch does not remove the initial route. Businesses should verify unexpected support contacts through a previously known phone number or internal channel, restrict external Teams access where it is unnecessary, and closely control who may start remote support sessions. For organisations assessing this exposure, AEU-I provides security-first IT, infrastructure and consulting. The central warning for site owners and IT teams is that a routine-looking support chat can become a route to account discovery, data theft and ransomware once remote access is granted.