Fake help desk on Microsoft Teams: malware in under 15 minutes

First, the mailbox fills up with hundreds of newsletters and subscription confirmations nobody asked for. A few minutes later, on Microsoft Teams, an “IT technician” gets in touch and offers to fix the problem. This is the pattern documented by Arctic Wolf in more than 400 incidents and covered on 26 and 27 October 2026 by The Hacker News, Help Net Security, Infosecurity Magazine and Dark Reading: in some cases less than 15 minutes pass between the first contact and malicious code running, and some intrusions ended with data theft and ransomware.

The research is reported in full mainly by Help Net Security: the figures and technical details that follow come from there, while the other outlets confirm the pattern and the timing.

What happened

The attack does not exploit any Teams vulnerability. It abuses a legitimate feature: external access (federation), on by default, which lets a user in another Microsoft 365 tenant find, chat with and call an organisation’s employees, provided both tenants allow it. According to the researchers it is the feature most often abused in these cases, and moving the conversation to Teams bypasses the suspicion employees have learned to apply to email.

The attackers build credible identities:

• 30 to 40% of cases use free onmicrosoft.com tenants, set up in minutes with no verification, with names such as “helpdeskteam365” or “itcoreportal”;
• more recently they have moved to paid domains: about 50% on .top, about 40% on .com and just over 5% on multi-level domains such as .com.pl, .com.vn and .com.br. Sophos had already described the same shift in the Chaos ransomware campaign;
• display names add “(Internal)”, even though Teams flags the sender as external, or a first name such as “IT Service Desk (Matthew)”; in the latest cases they include the victim company’s name or domain, and some messages are in the local language. More than 100 names contain emoji (shields, wrenches), which Arctic Wolf believes may point to identities generated with AI tools.

The outlets note that the technique is not new: Microsoft described it in mid-2024 in attacks linked to Black Basta, and it has since appeared in Cactus, 3AM and Chaos operations. Dark Reading suggests the current campaign might be tied to Black Basta, without firm attribution.

The attack chain

1. Email bombing: the victim’s mailbox is flooded with sign-ups and confirmations.
2. Teams contact from an external tenant, often aimed at several employees within roughly five minutes: the researchers believe this is most likely automated.
3. Teams voice call and a request to install a remote access tool. The most common is Quick Assist, which ships with Windows: the victim only has to read back a six-digit code. AnyDesk and ScreenConnect also appear, often as a second way in that remains after the first is removed.
4. No links in the chat, where they would be scanned: the attacker downloads the malicious files during the remote session.
5. Execution: in one case the fake technician had the employee run a PowerShell command that triggered a chain of hidden scripts; the last one installed a Python implant that collected the names and descriptions of every user and computer account in Active Directory and sent them to attacker-controlled servers.

In some cases the credential theft alert fired at the same time as the alert for the first Teams chat: by the time anyone looked, the machine was already compromised.

MITRE ATT&CK techniques

Based on what has been described, the chain maps to: Email Bombing (T1667), Impersonation (T1656), Spearphishing via Service (T1566.003) and Spearphishing Voice (T1566.004), Remote Access Tools (T1219), PowerShell (T1059.001), Domain Account Discovery (T1087.002) and Exfiltration Over C2 Channel (T1041), up to Data Encrypted for Impact (T1486) in the ransomware cases. The sources publish no CVEs and no indicators beyond the naming and domain patterns.

Impact for European and Italian organisations

Any organisation using Microsoft 365 with open Teams federation is exposed, whatever its sector. The speed leaves little room for detection: the defence has to lie mainly in configuration and procedures.

For NIS2 entities (in Italy, Legislative Decree 138/2024) staff training, access control and incident handling are required measures, and ransomware that disrupts services may be a significant incident to notify to CSIRT Italia. The list of Active Directory accounts, with names and descriptions, contains personal data: its theft must be assessed as a breach under the GDPR.

What to do now

1. Restrict Teams external access: if you don’t need it open to everyone, allow external chats only with partner domains (allow list).
2. Block unmanaged Teams accounts and trial tenants in the external access settings.
3. Cut down remote access tools: Quick Assist, AnyDesk, ScreenConnect and similar only for authorised IT staff, with application control on all other computers.
4. Tell staff clearly how IT contacts them: real support never writes from external tenants and never asks people to install remote access software. Every request is verified through a known internal channel.
5. Correlate the signals: a spike in subscription emails followed by an external Teams chat, Quick Assist or new remote access software starting, PowerShell with chained scripts, Python interpreters in user folders and bulk Active Directory queries.
6. Prepare the response: anyone who receives a suspicious contact must know whom to report it to immediately, and the machine should be isolated before investigating.

How ARXDOME helps

On computers and servers running the ARXDOME agent, ARX Sentry collects the inventory of software, processes and ports: an AnyDesk or ScreenConnect that appears without authorisation stands out. The SOC pages show events, logons and remote desktop sessions, with MITRE ATT&CK tactics per machine. If a machine is suspicious, ARX Shield isolates it from the network with one click and releases it only when it is safe to do so.

Last updated: 27 October 2026