Microsoft Teams Impersonation Scams Lead to Malware and Ransomware
Arctic Wolf Labs has identified a recurring social-engineering pattern in hundreds of incidents where attackers use Microsoft Teams external chats to impersonate IT support, deliver malware and, in some cases, deploy Chaos ransomware. The campaigns rely on newly created or acquired Microsoft 365 tenants, IT-themed identities and legitimate remote monitoring and management tools rather than a software vulnerability.
Nearly 30–40% of the cases investigated by Arctic Wolf involved *.onmicrosoft.com domains, the permanent fallback domains Microsoft automatically generates when a Microsoft 365 tenant is created. Threat actors chose tenant names resembling support infrastructure, including help desk and endpoint themes, to make their Teams identities appear credible.
From inbox flooding to remote access
The Teams contact often follows mail bombing, in which victims receive hundreds of newsletter or subscription confirmations within a short period. The volume is intended to create urgency. Soon afterwards, a purported IT-support representative offers assistance through an external Teams chat.
Observed display names include variants of Help Desk, IT Service Desk and IT Support, sometimes paired with approachable first names. In more recent cases, attackers added the target organisation's company name or domain to the display name. Arctic Wolf also reported a shift towards paid domains: about half of the identified fake identities used the .top top-level domain, around 40% used .com, and just over 5% used multi-level domains such as .com.pl, .com.vn and .com.br.
The activity aligns with STAC4749, a cluster linked to IT-themed cloud domains under .top and plausible employee usernames. Sophos has associated attacks of this kind with the deployment of Chaos ransomware. Organisations with external Teams access enabled are the intended targets.
Legitimate tools become the entry point
Attackers use vishing and Teams messages to convince targets to grant hands-on-keyboard access via legitimate tools, including Microsoft Quick Assist, AnyDesk, ScreenConnect from ConnectWise, TeamViewer, Atera, Zoho Assist, NetSupport and LogMeIn. Once connected, they can conduct reconnaissance, introduce further payloads such as the GoGRPC backdoor, move towards domain controllers, deploy Level for redundant remote access, exfiltrate data and drop ransomware.
In a subset of cases, Arctic Wolf observed the misuse of Microsoft notes. Operators generally avoid placing a URL directly in Teams, where Safe Links and Zero-hour Auto Purge scanning could be triggered. Instead, they navigate to the payload during the remote session, increasing the importance of endpoint and identity telemetry alongside message scanning.
PowerShell chain reaches Active Directory
In one case, the victim was told to run a PowerShell command that downloaded an MSI installer from Microsoft Azure Blob Storage. Running the installer launched a PowerShell script that extracted and executed an embedded Python implant. The backdoor then initiated another MSI transaction, queried Active Directory through LDAP for computer and user objects, and sent the collected information to an external server.
The practical implication is to treat unsolicited external Teams support chats as an identity-verification issue: restrict external access where appropriate, independently validate support requests, and monitor endpoint and identity activity for suspicious use of remote-access tools.