Attackers Impersonate IT Support on Microsoft Teams to Deploy Malware
Threat actors are exploiting Microsoft Teams' external chat feature to impersonate IT support, tricking users into downloading malware and ransomware through social engineering tactics.
Cybersecurity researchers have identified a persistent and widespread social engineering tactic where threat actors leverage Microsoft Teams' external chat functionality to impersonate IT support personnel. This method has been observed in hundreds of incidents, with attackers consistently using the same throwaway Microsoft 365 tenants, "IT Support (Internal)" display names, and remote-access tools to deliver malicious payloads.
The attackers establish their presence through newly created or acquired Microsoft 365 tenants, often utilizing the default *.onmicrosoft[.]com domain. These domains are frequently named with terms like "helpdeskteam365" or "corporateitservicellc" to mimic legitimate IT infrastructure. This impersonation is often preceded by "mail bombing," where a victim's inbox is flooded with spam, creating a sense of urgency that makes the subsequent IT support message appear as a solution to an urgent problem.
Display names used by the attackers are designed to appear official and helpful, ranging from simple "Help Desk" and "IT Support" to more elaborate "IT Service Desk – Liam" or "Enterprise IT & Security (Internal)." In some recent campaigns, threat actors have even incorporated the target organization's name into their display names to enhance credibility and bypass external-user warnings within Teams.
While initially relying on the *.onmicrosoft[.]com domains, attackers have recently shifted towards using paid top-level domains (TLDs) for tenant creation. Approximately 50% of these fake identities have been observed using the .top TLD, with .com and various multi-level domains like .com.pl also being utilized. This aligns with the tactics of known threat groups like STAC4749, which has a history of creating IT-themed cloud domains under the .top TLD.
The attacks specifically target organizations that permit external access within Microsoft Teams. The social engineering often escalates to vishing, where victims are persuaded to grant hands-on-keyboard access. This access is typically obtained through legitimate remote monitoring and management (RMM) tools such as Quick Assist, AnyDesk, or TeamViewer. Once access is gained, attackers conduct reconnaissance, deploy backdoors like GoGRPC, move laterally to domain controllers, and ultimately deploy ransomware.
Attackers are careful to avoid directly pasting malicious URLs into Teams chats, as this would trigger security features like Safe Links or Microsoft Defender for Office 365's Safe Attachments. Instead, during the remote session, they navigate to the payload themselves. In one documented instance, a victim was instructed to run a PowerShell command to download an MSI installer from Microsoft Azure Blob Storage, which then extracted and executed a Python implant. This implant queried Active Directory for user and computer information before exfiltrating it to an external server.
This attack vector exploits trust rather than software vulnerabilities, making it highly effective. The combination of email bombing, convincing IT support impersonation, newly created cloud infrastructure, and rapid social engineering allows attackers to quickly transition victims from a seemingly routine chat to full system compromise, including data exfiltration and ransomware deployment.
Organizations using Microsoft Teams should review their external access policies, educate users about these specific social engineering tactics, and ensure robust endpoint and identity telemetry are in place to monitor for suspicious activity. Disabling external chat or implementing stricter controls can also mitigate this risk.