Microsoft Teams IT Support Phishing Campaign

Arctic Wolf Labs has reported a significant campaign involving over 400 incidents where threat actors abuse Microsoft Teams' external chat functionality to impersonate IT support personnel. The attack begins with 'email bombing' flooding a victim's inbox with newsletter subscriptions to create a sense of urgency. An attacker then contacts the victim via Teams, often utilizing a voice call (vishing), to 'assist' with the issue, ultimately leading the victim to grant remote access via tools like Quick Assist.

The technical execution is rapid, often reaching payload execution in under 15 minutes. Attackers utilize both default .onmicrosoft.com tenants and paid domains (frequently using the .top TLD) that masquerade as corporate IT services. Once remote access is gained, they deploy secondary persistence tools and perform reconnaissance via LDAP queries, which can lead to data exfiltration or ransomware deployment.

This campaign is effective because the first contact arrives as a Teams chat, outside the email channel and it relies on trust in IT support. Organizations are advised to restrict Teams external access to trusted domains and monitor for unauthorized remote access tool execution.