Organizations with Microsoft Teams external access enabled are being targeted through impersonated IT-support chats that can progress from social engineering to remote access, malware deployment and ransomware, according to reporting on an Arctic Wolf Labs investigation. The researchers examined hundreds of cases and found repeated use of newly created or acquired Microsoft 365 tenants, help-desk-themed identities and attacker-controlled domains. The Hacker News reports that 30–40% of the investigated cases involved *.onmicrosoft[.]com domains.
The activity is not described as exploitation of a Teams software vulnerability. Instead, attackers use external chat to establish trust, often after flooding a target’s inbox with subscription or newsletter messages. They then persuade victims to grant hands-on-keyboard access through legitimate remote monitoring and management tools including Quick Assist, AnyDesk, ScreenConnect, TeamViewer and others. Arctic Wolf reported follow-on reconnaissance, delivery of the GoGRPC backdoor, lateral movement and data exfiltration; the report also says some incidents ended with Chaos ransomware deployment. These observed behaviors do not establish that every targeted organization was compromised.
The practical exposure question is whether external Teams contact is enabled and whether endpoint and identity telemetry can detect remote-access activity and suspicious payload execution. Arctic Wolf said attackers may avoid pasting payload URLs directly into Teams, making those telemetry sources important alongside message scanning.
A separate Microsoft campaign disclosure provides relevant identity-response context, but is not presented as a Teams-specific fix. Microsoft said password resets alone may be insufficient when active session cookies or attacker-created inbox rules remain in place, and advised phishing-resistant multifactor authentication, conditional access and continuous access evaluation. The Hacker News’ report on that Microsoft disclosure documents the distinction between resetting credentials and removing persistence from compromised cloud identities. The Teams report does not establish the full number of organizations compromised in the activity it describes.