Arctic Wolf Labs investigated more than 400 incidents in which attackers used the external chat feature of Microsoft Teams to impersonate IT support. Using Quick Assist and other RMM tools, they can sometimes gain access within 15 minutes. They are increasingly using .top domains for this purpose.
Arctic Wolf has identified a strikingly consistent pattern: the same disposable tenants, the same display names such as “IT Support (Internal),” and the same remote-access tools. There is no vulnerability in Teams itself. Attackers exploit external access (federation), a feature that is enabled by default. This allows any Teams user in one Microsoft 365 tenant to find, message, and call employees in another tenant, as long as both tenants permit it.
It often starts with email bombing. Within minutes, the victim’s inbox fills up with hundreds of newsletters and subscription confirmations. Shortly afterward, a helpful “IT employee” contacts the victim via Teams, offering to resolve the issue, an issue that the attacker created in the first place.
From onmicrosoft.com to .top
In 30 to 40 percent of cases, the attackers used a standard *.onmicrosoft.com domain. Such a domain requires no verification and is ready within minutes. Tenant names like helpdeskteam365 or networkadmin916 are meant to inspire trust. However, the trend is shifting toward paid domains. About 50 percent of these end in .top, and about 40 percent in .com.
Display names are also becoming more sophisticated. Attackers append “(Internal)” to their names, while Teams simultaneously marks the sender as “External.” Others add a first name (“IT Service Desk (Matthew)”) or even the target’s company name. An interesting detail: in over a hundred cases, the names contain emojis, such as a shield or a tool. According to Arctic Wolf, this may indicate the use of AI.
At the helm within fifteen minutes
The goal is usually to gain hands-on-keyboard access via a legitimate RMM tool. Quick Assist is a favorite: built into Windows, signed by Microsoft, and the victim only needs to read a six-digit code aloud. For persistence, attackers use AnyDesk, Atera, or ScreenConnect. If a victim cooperates, the payload runs within 15 minutes. Attackers deliberately avoid pasting links into the chat, as this triggers Safe Links.
Arctic Wolf detects the attacks at the ChatCreated event, the first one-on-one chat. “Our alerts most often go off right there, even before the user has done anything,” the company says.
Tip: ClickShare Hub: the missing link between BYOD and Microsoft Teams Room