Fake IT Support on Microsoft Teams: How Attackers Turn a Routine Chat into a Ransomware Attack
A message from “IT Support” appears in your Microsoft Teams. Your inbox has just been flooded with hundreds of spam emails, and the helpful technician offers to fix it. It feels like exactly the kind of help you need, which is why this scam works so well.
What researchers found
Arctic Wolf Labs reported what it calls a recurring social engineering pattern across hundreds of cases. Attackers use Teams’ external chat feature to message employees from outside the organization while posing as the company’s help desk. No software vulnerability is involved. As the researchers put it, the attack exploits trust rather than a flaw, and the same tactics show up again and again: throwaway Microsoft 365 tenants, the same “IT Support (Internal)” style display names, the same remote-access tools and, increasingly, the same payload domains.
How the scam works
The attack usually begins with mail bombing, where the victim’s inbox is flooded with hundreds of newsletter or subscription confirmations in a short time. This creates a false sense of urgency, and the Teams message from “IT” arrives soon after, offering to solve the problem. The attackers pick display names such as Help Desk, IT Service Desk, Enterprise IT & Security (Internal) or a friendly first name, in order to slip past Teams’ warnings about external users. In recent cases they have started adding the target company’s own name to make the message look more authentic.
The accounts come from newly created or purchased Microsoft 365 tenants. In 30 to 40 percent of the cases Arctic Wolf investigated, the sender used a free onmicrosoft.com domain with a help-desk-style name. Lately the attackers have shifted toward paid domains, with about half of those using the .top domain ending and around 40 percent using a standard .com.
From chat to full compromise
Once the victim is convinced, the attacker talks them into granting hands-on access through a legitimate remote support tool such as Quick Assist, AnyDesk, ScreenConnect, TeamViewer or similar software. This voice-and-chat approach is called vishing when a phone call is involved. With access, the attackers carry out reconnaissance, install further tools like the GoGRPC backdoor, move toward domain controllers, add a second remote-access tool for redundancy, steal sensitive data and finally drop ransomware. In one case, the victim was told to run a PowerShell command that downloaded an installer from Azure Blob Storage, which unpacked a hidden Python backdoor that queried Active Directory for all computers and users and sent the results to an outside server.
The activity matches a cluster tracked as STAC4749, which has a history of creating IT-themed domains and plausible employee usernames, and Sophos has linked such attacks to the deployment of Chaos ransomware.
Why it slips past defenses
The attackers usually avoid pasting links into Teams, since that would trigger Microsoft’s link scanning. Instead they guide the victim to the payload during the remote session. Arctic Wolf therefore stresses that security teams need to watch endpoint and identity activity as well as scanning messages. The scam also targets organizations that allow external access in Teams, so the more open the setting, the greater the exposure.
How to protect your organization
The article itself focuses on detection, but common-sense steps follow from it. Restrict or tightly control which outside organizations can message your staff in Teams, and block or flag new tenants and look-alike names such as “IT Support (Internal).” Limit which remote access tools can be installed and alert when one appears unexpectedly. Train employees to treat unsolicited IT contact with suspicion, especially right after an inbox flood, and to verify through a known internal channel before giving anyone access to their computer. Real IT teams rarely ask staff to run commands that a stranger dictates.
Final thoughts
This campaign shows that the weakest point is often a helpful person, not unpatched software. Attackers invest in believable names, good timing and a sense of urgency, so a calm habit of verifying first is one of the best defenses a company can build.
Comments