[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fdWUhH6qQCteeMhtWBbp4J29OqDsuLzmkwPm9ZEUX0NU":3},{"article":4,"iocs":56,"watch_terms":75,"solutions":76,"lesson":172},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"f310d796-f2dc-4764-ac90-16c221fc8663","Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware","attackers-use-microsoft-teams-it-support-scams-to-deploy-malware-and-ransomware-4b8826","Cybersecurity researchers are calling attention to what they say is a \"recurring social engineering pattern\" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malware. \"A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same 'IT","Cybersecurity researchers have identified a widespread social engineering campaign where threat actors use Microsoft Teams' external chat feature to impersonate IT support staff and trick users into granting remote access. Attackers create throwaway Microsoft 365 tenants with spoofed IT-themed display names, often preceded by mail bombing to create urgency, then use legitimate RMM tools to deliver malware including Chaos ransomware, GoGRPC backdoors, and conduct lateral movement. The campaign targets organizations with external access enabled and exhibits consistent patterns in domain naming (*.onmicrosoft.com fallback domains and increasingly .top TLDs), display names, and payload delivery methods.","Attackers abuse Microsoft Teams external chat to impersonate IT support and deploy malware and ransomware.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fattackers-use-microsoft-teams-it.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhGj3R5UeJnb_pAG2XH5cEGUzKbzeRHLNAES48EgHC8ssOnuDbDOqJA9ydPHJqmxYONu2lCeu42YOv_e_XA2RtX5jVGsMkQY0QAGrzoqmY4qU6NnWrPTfX0V-U68B9Z80KHLJvZDtUeSm4dvkp06oJ9JmgJvr7CDYZ-48fwAOENt31Lrcpr4M6O_4x6ovLZ\u002Fs1600\u002Fsupport.jpg","2026-10-26T15:52:40+00:00","2026-10-26T18:00:18.755227+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"Microsoft Teams","product",{"name":21,"type":19},"Microsoft 365",{"name":23,"type":19},"Quick Assist",{"name":25,"type":19},"AnyDesk",{"name":27,"type":19},"ScreenConnect",{"name":29,"type":19},"TeamViewer","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":52},{"id":53,"icon":32,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,61,63,65,67,69,72],{"type":58,"value":59,"context":60},"domain","helpdeskteam365.onmicrosoft.com","Spoofed IT support domain used in Teams impersonation scams",{"type":58,"value":62,"context":60},"itendpoint365.onmicrosoft.com",{"type":58,"value":64,"context":60},"itcoreportal.onmicrosoft.com",{"type":58,"value":66,"context":60},"itadmin922.onmicrosoft.com",{"type":58,"value":68,"context":60},"corporateitservicellc.onmicrosoft.com",{"type":50,"value":70,"context":71},"Chaos ransomware","Ransomware deployed in final stages of attack chain",{"type":50,"value":73,"context":74},"GoGRPC backdoor","Additional payload deployed for persistence and lateral movement",[18,21,23],{"controls":77,"vendors":162},[78,107,136],{"slug":79,"name":80,"problem":81,"products":82},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":108,"name":109,"problem":110,"products":111},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"slug":137,"name":138,"problem":139,"products":140},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[141,147,154],{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":142,"product_name":143,"url":145,"description":146},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":148,"product_name":151,"url":152,"description":153},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":155,"vendor_name":156,"vendor_logo":157,"product_slug":158,"product_name":159,"url":160,"description":161},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[163,169],{"slug":164,"name":165,"logo_path":166,"roles":167},"arctic-wolf","Arctic Wolf","\u002Fvendor-logos\u002Farctic-wolf.png",[168],"reported_by",{"slug":121,"name":122,"logo_path":123,"roles":170},[171],"affected",{"slug":173,"title":174,"body":175,"framework_refs":176,"framework_notes":184},"teams-it-support-impersonation-scams-deliver-ransomware-via-trusted-remote-access-tools","Teams IT Support Impersonation Scams Deliver Ransomware via Trusted Remote Access Tools","Threat actors are exploiting Microsoft Teams' external chat functionality to impersonate IT support personnel, first overwhelming users with mail bombs to manufacture urgency, then convincing them to grant remote access via legitimate RMM tools. Because the attackers use real Microsoft 365 tenants with convincing IT-themed display names, users have little technical signal to distinguish the scam from genuine helpdesk contact. Once remote access is granted, attackers deploy ransomware, backdoors, and conduct lateral movement — all under the cover of trusted software. This campaign highlights how social engineering can completely bypass technical controls when users are not trained to verify identity through out-of-band channels. The widespread enablement of external Teams access without compensating controls creates a large, exploitable attack surface.",[177,178,179,180,181,182,183],"CIS Control 14: Security Awareness and Skills Training","MITRE ATT&CK T1566: Phishing","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 17: Incident Response Management","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","NIS2 Article 21(2)(b)","CIS Control 4: Secure Configuration of Enterprise Assets and Software",{"NIS2 Article 21(2)(b)":185,"MITRE ATT&CK T1566: Phishing":186,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":187,"CIS Control 17: Incident Response Management":188,"CIS Control 14: Security Awareness and Skills Training":189,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":190,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":191},"NIS2 requires organisations to implement incident handling and policies on human-factors security, both of which would mandate controls against social engineering campaigns of this type.","The campaign uses spear-phishing via Microsoft Teams messages — a direct instance of this technique — making detection and user training against Teams-based phishing vectors essential.","Ensuring staff are competent to recognise social engineering tactics — including impersonation over collaboration tools — directly addresses the human failure point this campaign exploits.","A defined incident response process including procedures for reporting suspicious IT contact attempts would enable faster triage and containment when mail bombing or rogue Teams messages are detected.","Users who could not identify IT impersonation scams or knew to verify support requests through official channels would have broken the attack chain before any malware was deployed.","Hardening Microsoft Teams external access settings — restricting unknown tenants and external chat — is a configuration management action that would have denied attackers their primary attack vector.","Robust identity verification controls and access policies would have prevented attackers from posing as IT staff and obtaining user-granted remote access without validated authentication."]