Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware

What happened

These messages originate from Teams identities established through newly created or acquired Microsoft 365 tenants. Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malware. Microsoft is a software and software development company based in Redmond.

"A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same 'IT Support (Internal)' display names, the same remote-access tools, and increasingly, the same payload domains," Arctic Wolf Labs said in a report shared with The Hacker News. The attacks consistently employ IT-themed display names or friendly-sounding first names to subvert external-user warnings in Teams.

Nearly 30–40% of the cases investigated by the cybersecurity company involve the use of *.onmicrosoft[.]com , a permanent fallback domain automatically generated by Microsoft when a Microsoft 365 tenant is created. The approach is designed to induce a false sense of urgency, with the Teams IT support message arriving soon after to help resolve the problem.

The activity aligns with that of STAC4749 , has a history of creating IT-themed cloud domains under the ".top" TLD and leveraging plausible employee usernames to make the accounts appear authentic. These attacks have led to the deployment of Chaos ransomware (software that locks up files and demands payment), according to Sophos .

The attacks specifically go after organizations where external access is enabled. This also involves an element of vishing to trick victims to granting them hands-on-keyboard access through a legitimate remote monitoring and management (RMM) tool like Quick Assist, AnyDesk, ScreenConnect (ConnectWise), TeamViewer, Atera, Zoho Assist, NetSupport, and LogMeIn.