[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"post:microsoft-teams-it-support-scams-mail-bombing-fake-help":3},{"post":4,"author":19,"controls":26,"vendors":27,"more":28},{"slug":5,"kind":6,"title":7,"excerpt":8,"cover_image_url":9,"cover_image_alt":10,"author_name":11,"published_at":12,"body_md":13,"author_title":14,"regulation_refs":15,"ai_assisted":16,"cover_ai_generated":17,"updated_at":12,"reading_minutes":18},"microsoft-teams-it-support-scams-mail-bombing-fake-help","rapid-alert","Microsoft Teams IT support scams: mail bombing, fake help desks, remote access and Chaos ransomware","Arctic Wolf documented more than 400 cases of attackers abusing Microsoft Teams external chat to pose as IT support, flood inboxes with spam, then talk staff into granting remote access. Some intrusions ended in data theft and ransomware. No Teams bug is involved.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fmicrosoft-teams-it-support-scams-mail-bombing-fake-help-6423377f-cover.png","Teams IT Scam rapid alert: Is Teams external chat on? A stranger can reach every employee.","Marcus Lenngren","2026-10-28T06:09:32.672+00:00","![Teams IT Scam rapid alert: Is Teams external chat on? A stranger can reach every employee.](https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fmicrosoft-teams-it-support-scams-mail-bombing-fake-help-6423377f-card.png \"The rapid alert card: save it and share it with your team\")\n\n## What happened\n\nArctic Wolf Labs has documented more than 400 incidents in which attackers abuse Microsoft Teams external chat to pose as internal IT support and talk employees into granting remote access to their Windows PCs. This is not a Teams vulnerability. It abuses external access (federation), a legitimate feature that ships turned on by default, letting any Teams user in another Microsoft 365 tenant find, chat with and call your staff when both tenants allow it.\n\nThe pattern is consistent: the same throwaway tenants, the same \"IT Support (Internal)\" display names, the same remote tools and, increasingly, the same payload domains. The activity aligns with the actor tracked as STAC4749 and has led to Chaos ransomware, according to Sophos. The technique has previously appeared in Black Basta, Cactus and 3AM operations.\n\n## Timeline\n\n- Minutes before contact: the victim's inbox is flooded with hundreds of newsletter and subscription confirmations (mail bombing) to create urgency and bury alerts.\n- Within about five minutes: the attacker contacts several employees, likely via automation.\n- The fake technician moves to a Teams voice call and asks the victim to install or allow a remote tool.\n- In under 15 minutes from engagement, malicious code starts running.\n- About 30 seconds after an MSI installs, a script runs from AppData and decrypts the next stage.\n- After a five second delay, a Python implant queries Active Directory and exfiltrates account data.\n- 26 Oct 2026: Arctic Wolf publishes its report.\n\n## Am I affected?\n\nYou are exposed if Teams external access (federation) is open to any outside tenant rather than limited to named partner domains, and if staff can install or run remote tools such as Quick Assist, AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport or LogMeIn.\n\nBetween 30 and 40 percent of cases used free *.onmicrosoft.com tenants such as helpdeskteam365, itcoreportal and itadmin922. Of paid domains seen in recent months, about half used the .top TLD, around 40 percent used .com, and just over five percent used multi-level domains like .com.pl, .com.vn and .com.br. Display names include \"IT Support\", \"IT Service Desk (Liam)\" and names with \"(Internal)\" appended. Attackers sometimes add your company name or domain to their display name.\n\n## What to do now\n\n1. Restrict Teams external access to specific approved partner domains. Do not allow chats from any outside tenant.\n2. Block chats from unmanaged Microsoft 365 accounts and trial-only tenants.\n3. Restrict Quick Assist and other RMM tools to authorised IT staff only; remove or block the rest.\n4. Tell staff now: a Teams message, even one labelled \"Internal\", is not proof of identity. Verify any unsolicited IT request through a known helpdesk number or portal.\n5. Treat a burst of subscription spam as a warning sign and report it before engaging with any \"IT\" follow-up.\n\n## How to hunt\n\n- Treat the Teams ChatCreated event from an external tenant as an early detection point, then correlate it with mail flooding, remote tool launches, PowerShell activity and identity alerts.\n- Endpoint and identity telemetry are essential: attackers avoid pasting URLs in Teams to dodge Safe Links and ZAP, and download payloads themselves during the session.\n- Look for PowerShell that fetches an MSI from Azure Blob Storage, and for artefacts in AppData\\Local\\PowershellCleaner\\scripts, plus files archive6.zip, cleaner.ps1, ss.py and pythonw.exe.\n- Watch for MSI transactions issuing LDAP queries for all computer and user objects.\n- Block the reported onmicrosoft.com tenants and .top payload and C2 domains listed in the IoCs.\n\n## What does not help\n\n- There is no patch to apply. This is a default-on feature being abused, not a software flaw.\n- Teams' external-user warning does not stop the attack; a friendly or \"Internal\" display name is designed to make staff ignore it.\n- Message scanning alone is not enough, because the attackers never paste links into the chat.\n\n## Sources\n\n- [Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware](https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fattackers-use-microsoft-teams-it.html), The Hacker News, 26 Oct\n- [Hackers Impersonate IT Support on Microsoft Teams to Gain Remote Access to Employees’ PCs](https:\u002F\u002Fcybersecuritynews.com\u002Fit-support-on-microsoft-teams\u002F), Cyber Security News, 27 Oct\n- [Hackers Abuse Microsoft Teams External Chats to Access Corporate PCs](https:\u002F\u002Fhackread.com\u002Fhackers-abuse-microsoft-teams-external-chats-pc\u002F), Hackread, 27 Oct\n- [Hackers bury inboxes in spam then show up on Microsoft Teams posing as IT support](https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F10\u002F27\u002Fmicrosoft-teams-social-engineering-fake-it-help-desk\u002F), Help Net Security, 27 Oct\n",null,[],true,false,3,{"name":11,"slug":20,"same_as":21,"job_title":22,"photo_url":23,"short_bio":24,"linkedin_url":25},"marcus-lenngren",[],"Founder, ThreatNoir","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fauthors\u002Fmarcus-lenngren-ca3a2dad9da5.jpg","Founder of ThreatNoir. Security and technology leader: CTO and CISO in a regulated industry, head of applications, network and data centre at Schibsted Sverige, and today security engineering for a global retailer's SOC. CISSP, CISM and AAISM.","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmarcuslenngren",[],[],[29,36,43],{"slug":30,"kind":6,"title":31,"excerpt":32,"cover_image_url":33,"cover_image_alt":34,"author_name":11,"published_at":35,"reading_minutes":18},"check-point-gaia-under-attack-php2shell-chained-to-root-for","Check Point Gaia under attack: PHP2Shell chained to root for ESXi wiper, patch now","Attackers are chaining PHP2Shell (CVE-2026-109618\u002F9) with a DynamicCLI root flaw (CVE-2026-123039) on Check Point Mobile Access gateways, then wiping VMware ESXi hosts. Patch and hunt tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcheck-point-gaia-under-attack-php2shell-chained-to-root-for-05b9bf1d-cover.png","Check Point Gaia rapid alert: Mobile Access portal exposed? One chain and your ESXi is wiped.","2026-11-13T11:18:49.874+00:00",{"slug":37,"kind":6,"title":38,"excerpt":39,"cover_image_url":40,"cover_image_alt":41,"author_name":11,"published_at":42,"reading_minutes":18},"4everable2shell-n-central-hotfix-2-servers-taken-to-root","4EverAble2Shell: N-central Hotfix 2 Servers Taken to Root Hours After PoC Dropped","A new N-able N-central exploit chain, 4EverAble2Shell, gives unauthenticated root on servers running the latest Hotfix 2. Attackers began mining within hours of the PoC, hitting 21 servers, 19 of them patched. Disable Legacy API and take on-prem N-central offline now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002F4everable2shell-n-central-hotfix-2-servers-taken-to-root-68758f4e-cover.png","N-central HF2 rapid alert: Patched N-central to Hotfix 2? Root on the box running your clients.","2026-11-13T08:52:08.367+00:00",{"slug":44,"kind":6,"title":45,"excerpt":46,"cover_image_url":47,"cover_image_alt":48,"author_name":11,"published_at":49,"reading_minutes":18},"citrus-ransomware-abuses-group-policy-to-push-sn00py-and","Citrus ransomware abuses Group Policy to push Sn00py and disable Microsoft Defender across domains","Citrus, a newly documented crew tracked by Securelist, uses stolen contractor logins to reach a domain controller, then builds a malicious GPO named Kaspersky GPO that drops Sn00py ransomware and turns off Defender on every joined machine.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcitrus-ransomware-abuses-group-policy-to-push-sn00py-and-fb0efdd6-cover.png","Citrus Ransomware rapid alert: Your DC pushes GPOs to everyone? One policy kills Defender domain-wide.","2026-11-12T08:02:16.435+00:00"]