Ethical Hacking News
Cybersecurity researchers are warning of a growing threat landscape where attackers are using Microsoft Teams to conduct sophisticated social engineering attacks and deploy malware. The attackers are using the same tactics and tools to trick victims into granting remote access to their systems, which ultimately leads to the deployment of ransomware and the exfiltration of sensitive data. To stay ahead of these threats, it is essential to stay informed and take proactive measures to secure your systems and networks.
Attackers are using Microsoft Teams to conduct sophisticated social engineering attacks and deploy malware. They use the same tactics and tools to trick victims into granting remote access to their systems. Attackers use IT-themed display names or friendly-sounding first names to subvert external-user warnings in Teams. They use permanent fallback domains, such as *.onmicrosoft[.]com, to increase credibility. Attackers use mail bombing to flood victims' inboxes with hundreds of newsletter or subscription confirmations to induce a false sense of urgency. The attackers' tactics align with that of STAC4749, a group known for creating IT-themed cloud domains and leveraging plausible employee usernames. These attacks specifically target organizations where external access is enabled, using vishing to trick victims into granting hands-on-keyboard access. Endpoint and identity telemetry are essential monitoring surfaces to detect these attacks. Attackers use PowerShell commands to download and execute malware, including Python implants and ransomware.
In recent months, a new and concerning trend has emerged in the world of cyber threats, with attackers utilizing Microsoft Teams to conduct sophisticated social engineering attacks and deploy malware. This phenomenon has gained significant attention from cybersecurity experts, who have identified a "recurring social engineering pattern" across hundreds of cases. The attackers are using the same tactics and tools to trick victims into granting remote access to their systems, which ultimately leads to the deployment of ransomware and the exfiltration of sensitive data.
According to a report shared by Arctic Wolf Labs, the attackers are consistently employing IT-themed display names or friendly-sounding first names to subvert external-user warnings in Teams. These messages originate from Teams identities established through newly created or acquired Microsoft 365 tenants. The attackers are also using the same throwaway tenants, the same "IT Support (Internal)" display names, the same remote-access tools, and increasingly, the same payload domains.
One of the most striking aspects of these attacks is the use of permanent fallback domains, such as *.onmicrosoft[.]com, which are automatically generated by Microsoft when a Microsoft 365 tenant is created. These domains masquerade as IT infrastructure, opting for a help desk- or support-themed word as the tenant name to increase their credibility. For example, helpdeskteam365.onmicrosoft[.]com, itendpoint365.onmicrosoft[.]com, itcoreportal.onmicrosoft[.]com, and itadmin922.onmicrosoft[.]com are just a few of the many examples of these domains.
The attackers are also using a technique called "mail bombing," where the victim's inbox is flooded with hundreds of newsletter or subscription confirmations in a short span of time. This approach is designed to induce a false sense of urgency, with the Teams IT support message arriving soon after to help resolve the problem. The attackers are also using convincing IT-support impersonation, newly created tenants, and rapid social engineering to move victims from a seemingly routine chat to remote access, payload execution, and, in some cases, broader compromise.
In recent iterations, the attackers have been observed adding the target organization's domain or company name in their display name to lend the messages additional legitimacy. The attackers have also shifted towards using paid top-level domains (TLDs) for tenant creation, with approximately 50 percent of fake identities using the .top TLD, around 40 percent using a standard .com domain, and just over five percent using multi-level domains such as .com.pl, .com.vn, and .com.br.
The activity aligns with that of STAC4749, a group that has a history of creating IT-themed cloud domains under the ".top" TLD and leveraging plausible employee usernames to make the accounts appear authentic. These attacks have led to the deployment of Chaos ransomware, according to Sophos.
The attacks specifically go after organizations where external access is enabled. This also involves an element of vishing to trick victims to granting them hands-on-keyboard access through a legitimate remote monitoring and management (RMM) tool like Quick Assist, AnyDesk, ScreenConnect (ConnectWise), TeamViewer, Atera, Zoho Assist, NetSupport, and LogMeIn.
In a subset of cases, attackers leveraged Microsoft's notes, and instead of pasting a URL directly into Teams, which would trigger Safe Links / ZAP scanning, they navigate to the payload themselves during the remote session. Consequently, endpoint and identity telemetry are essential monitoring surfaces alongside message scanning.
In one case identified by the cybersecurity vendor, the threat actor instructed the user to run a PowerShell command to download a file and then launch it. The PowerShell command is designed to download an MSI installer from Microsoft Azure Blob Storage.
When the victim runs the installer, it launches a PowerShell script responsible for extracting and executing a Python implant embedded within it. The backdoor then runs another MSI transaction that issues LDAP queries to Active Directory for all computer and user objects and then transmits the information to an external server.
"External Microsoft Teams chat has become an effective initial-access vector because it exploits trust rather than a software vulnerability," Arctic Wolf said.
"Across the activity examined, attackers combined email bombing, convincing IT-support impersonation, newly created tenants and domains, and rapid social engineering to move victims from a seemingly routine chat to remote access, payload execution, and, in some cases, broader compromise," Arctic Wolf said.
Cybersecurity researchers are warning of a growing threat landscape where attackers are using Microsoft Teams to conduct sophisticated social engineering attacks and deploy malware. The attackers are using the same tactics and tools to trick victims into granting remote access to their systems, which ultimately leads to the deployment of ransomware and the exfiltration of sensitive data. To stay ahead of these threats, it is essential to stay informed and take proactive measures to secure your systems and networks.
Related Information:
https://www.ethicalhackingnews.com/articles/Exploiting-Microsoft-Teams-for-Malicious-Purposes-A-Growing-Threat-Landscape-ehn.shtml
https://thehackernews.com/2026/10/attackers-use-microsoft-teams-it.html
Published: Mon Oct 26 22:47:28 2026 by llama3.2 3B Q4_K_M
