Attackers are using Microsoft Teams’ external chat feature to impersonate IT support and, in hundreds of cases, move from chat to hands-on access of victims’ devices. Security firm Arctic Wolf reports that offenders exploit default external access between Microsoft 365 tenants, initiating contact as an “IT Service Desk” agent and then transitioning to remote support tools. The timeframe described is often within about 15 minutes from the first reply.
Across the reporting, a recurring pattern includes inbox spam or notification flooding followed by a Teams message that offers to “fix” the problem the attackers created. Several outlets highlight how the attackers pick throwaway or plausible tenant names (including common IT/helpdesk-related words) to make sender identities look legitimate. The research also links the tactic to ransomware groups that have used Teams external chat as an initial access route, though the outlets do not identify the specific operators.
Some coverage emphasizes the impersonation and remote-access mechanics, while others focus more on the background techniques—such as tenant-name disguises and the use of remote monitoring tools like Windows Quick Assist. Overall, the sources largely agree on the core chain of events: spam or bait, Teams IT-support impersonation, then remote control to enable further compromise.
