Microsoft Teams is being hijacked by threat actors who impersonate internal IT staff to plant malware and ransomware via external chat conversations. Cybersecurity researchers uncovered a recurring scheme observed in hundreds of cases, where attackers use Microsoft Teams’ external chat feature to set up newly minted Microsoft 365 tenants. These fake accounts then pose as support or helpdesk personnel to establish trust with targets and infiltrate corporate environments.
How the Scam Plays Out
Attackers begin by creating or acquiring Microsoft 365 tenants—often using Microsoft’s fallback “*.onmicrosoft[.]com” domains—and name them to suggest they’re legitimate IT infrastructure, such as “HelpDesk Team” or “IT Service Desk.” Nearly one-third of the observed instances involved using these onmicrosoft.com domains. Display names are crafted to sound official and sometimes even include victims’ actual company names to bypass external-user warnings built into Teams. Additionally, threat actors are increasingly registering domains under paid top-level domains (TLDs) like .top, .com, and less commonly, country-specific multi-level domains (.com.pl, .com.vn, etc.), lending extra credibility to the scam.
Before the Teams approach, attackers often flood a target’s inbox with subscription or newsletter confirmations in what’s called “mail bombing.” This creates a sense of urgency, making it more likely a user will respond quickly when a message supposedly from IT support appears soon after. The external Teams message typically urges remote access via tools like AnyDesk, TeamViewer, Quick Assist, or ScreenConnect. Once access is granted, attackers can install backdoors, proliferate across domain controllers, extract credentials, and drop ransomware. In some cases, they also leverage legitimate Microsoft Notes to evade detection — avoiding suspicious elements like URLs in chats which trigger filters like Safe Links.
Payloads and Attack Infrastructure
The attackers use remote monitoring and management (RMM) tools to deepen their access and maintain persistence. Common tools abused include AnyDesk, NetSupport, Zoho Assist, and others. One observed incident involved prompting a victim to execute a PowerShell script which downloaded an MSI installer from Azure Blob Storage. That installer unpacked a Python-based implant and used LDAP queries to collect user and computer objects from Active Directory, then exfiltrated the data before deploying ransomware.
In certain cases, these schemes were tied to groups linked to Chaos ransomware, and many fake IT domains have been associated with a collective known as STAC4749. About half of fake paid domains used the .top TLD, and around 40% used .com. A small portion used multi-level domains from regions like Vietnam and Poland, presumably to access cheaper registration or to obfuscate origin.
Attackers are specifically targeting organizations where external access in Teams is enabled, and where users may already be trained to expect prompts or support outreach. Because the scam leverages social trust rather than exploiting unpatched vulnerabilities in the software, it’s harder to detect using traditional signature-based defenses. Researchers say that signing into telemetry for identity and endpoint behavior, along with message scanning, are crucial to spotting these attacks early on.
Analysts emphasize that this isn’t a one-off tactic—these groups are combining mail bombing, custom domains, display name spoofing, and remote access to turn a routine pop-up support chat into a sophisticated supply chain of compromise that ends in ransomware or data exfiltration. The threat is especially potent when identity-based detection is weak or external-user warnings are ignored.
This recurring attack technique marks a shift in how adversaries are gaining initial access. Rather than exploiting software bugs, they’re weaponizing trust and procedural expectations. Organizations must scrutinize external chats, validate display names carefully, restrict external tenant communication where possible, and strengthen logging and alerting around identity behavior.
