Watch out — that Microsoft Teams chat might be hackers impersonating your IT support
Fake IT support pushes victims into granting hands-on access via remote management tools.
Microsoft Teams chat may be hackers impersonating IT support, according to cybersecurity researchers. The attackers flood employees' inboxes with spam and then use Microsoft Teams to impersonate IT support. Once the victim believes the message is legitimate, the attacker requests remote access through a trusted tool like AnyDesk or ScreenConnect.
The attackers then install tools such as AnyDesk or ScreenConnect to maintain access and conduct reconnaissance for potential ransomware or malware attacks. This campaign is enabled by the default Teams federation settings, which allow employees to receive messages from anyone with a Microsoft 365 account, regardless of the tenant.
To protect against these attacks, Arctic Wolf recommends disabling any-tenant external chat in Teams and educating employees about the risks of trusting messages from Teams.
Written by urgent.news from TechRadar's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
