What happened
Arctic Wolf documented over 400 cases where attackers first inundated users’ email inboxes with newsletters, then immediately messaged the same users via Microsoft Teams external chat, masquerading as internal IT help‑desk staff. They create throw‑away Microsoft 365 tenants (free onmicrosoft.com or low‑cost .top domains), assign IT‑sounding display names—often appending “(Internal)”—and sometimes use AI‑generated avatars. Once a victim replies, the fake technician moves the conversation to a Teams voice call and asks the user to install remote‑access software such as Quick Assist, aiming to gain footholds in the victim environment. No vulnerability in Teams was exploited; the abuse relies on the default‑on federation feature that permits any external tenant to contact users if both sides allow external access.
Why it matters for trust and compliance
- The incident demonstrates why organizations must enforce strict controls over external collaboration settings and verify external identities, a control objective that supports audit readiness across frameworks.
- Continuous monitoring of external federation settings provides defensible evidence for audit of access‑control policies.
- Verified external‑tenant naming and verification processes satisfy multiple framework requirements for identity governance.
Who is affected
Enterprises using Microsoft Teams with external access enabled
Recommended actions
- Disable Teams federation unless business‑critical; if enabled, whitelist only vetted external tenants.
- Implement a policy that requires verification of any external tenant that can initiate chats or calls.
- Update security awareness programs to include Teams‑based social engineering scenarios.
- Deploy logging and alerting on external chat initiations and remote‑access tool installations.