Microsoft Teams has become an increasingly attractive entry point for threat actors, and new research highlights a persistent social engineering playbook that abuses the platform's external chat creation feature to impersonate IT support staff, harvest credentials, and in some cases deliver malware and ransomware.

According to reporting from The Hacker News, researchers describe a "recurring social engineering pattern" observed across hundreds of incidents. The common thread is not a novel exploit but a repeatable abuse of legitimate collaboration features that most organizations leave wide open.

How the Scam Works

The attack chain typically begins with an unsolicited message arriving in a victim's Teams client. Because Teams allows users to initiate chats with people outside their organization, an attacker can reach an employee directly without first compromising an account or breaching the perimeter.

The sender poses as a member of the target's IT help desk or support team. The pretext usually involves a routine-sounding problem: a device that needs re-enrollment, a password that must be reset, or a security update that requires the user to follow a link or install a tool. From the victim's perspective, the request arrives through a trusted corporate application, which lends it far more credibility than an email from an unknown address.

Researchers note that the campaigns share infrastructure and tradecraft. Attackers appear to reuse the same throwaway Microsoft 365 tenants and the same "IT support" pretext across many victims, suggesting a standardized, repeatable operation rather than isolated opportunism.

Why Teams Is an Effective Vector

Several characteristics make Microsoft Teams attractive to social engineers:

  • Trusted context. Messages appear inside an application employees use daily for legitimate work, bypassing the skepticism many users apply to email.
  • External access by default. Unless administrators restrict it, external users can start chats with internal staff, creating a direct channel into the organization.
  • Limited inspection. Security teams often apply less scrutiny to chat traffic than to email, meaning links and files shared in Teams may not be filtered by the same controls.
  • Identity blending. A convincing display name and profile photo can make a throwaway tenant look like a genuine internal support account.

From Impersonation to Ransomware

The consequences range from credential theft to full-scale ransomware incidents. In credential-focused variants, victims are directed to phishing pages styled as Microsoft sign-in portals. In more aggressive cases, the conversation is used to persuade users to run remote-support software or download payloads, giving attackers a foothold inside the network.

Once initial access is established, the usual post-exploitation activities follow: reconnaissance, privilege escalation, and lateral movement. In the most severe incidents, this progression has ended in ransomware deployment, turning a single chat message into a business-critical event.

Defensive Recommendations

Because the attacks rely on legitimate functionality rather than a vulnerability, mitigation is primarily about configuration and user awareness.

Restrict external access. Administrators should review Teams external access settings and allow communication only with explicitly trusted domains where business needs justify it. Blocking consumer domains that are rarely relevant to business operations reduces the attack surface considerably.

Harden tenant-level controls. Organizations should audit who can create external chats, monitor for suspicious guest and external tenant activity, and apply conditional access policies that limit risk from unfamiliar identities.

Improve detection coverage. Security operations teams should extend monitoring to collaboration platforms. Alerts for unusual external chat volume, newly created external tenants contacting many users, and links shared in chat can surface campaigns early.

Train employees on chat-based phishing. Awareness programs tend to focus on email. Employees should be taught that IT support will not request credentials, multi-factor authentication codes, or remote access through an unsolicited chat message, and that verification through a known internal channel is always appropriate.

Establish a reporting path. A simple, well-publicized way to report suspicious messages inside Teams lets employees flag attempts quickly and gives defenders visibility into campaigns targeting the organization.

The Bigger Picture

The Teams campaign reflects a broader trend: attackers increasingly operate inside the SaaS tools businesses depend on, exploiting trust and convenience rather than technical flaws. Collaboration platforms concentrate sensitive conversations and file sharing in one place, and every external chat feature is a potential doorway.

For defenders, the lesson is that identity and collaboration security deserve the same attention as endpoint and network controls. The attack described here is not sophisticated in a technical sense, but it is effective precisely because it looks ordinary. Closing the external chat gap and teaching staff to question unsolicited support requests are practical steps that reduce exposure to a pattern researchers expect to persist.

Organizations should treat this as an ongoing program rather than a one-time fix, periodically reviewing Teams configuration as business requirements and attacker tactics evolve.