Arctic Wolf Labs said on 26 October 2026 that it has seen a recurring social engineering pattern in hundreds of cases in which attackers used Microsoft Teams' external chat feature for impersonation scams or to deliver malicious files, with the same throwaway tenants, the same 'IT Support (Internal)' display names, the same remote-access tools and, increasingly, the same payload domains.

Arctic Wolf says the activity exploits no Teams vulnerability but abuses external access (federation), which is on by default, and that in a significant number of cases the Teams contact was preceded by 'mail bombing' that floods the victim's inbox with hundreds of newsletter or subscription confirmations.

According to Arctic Wolf, 30 to 40 percent of the cases it analysed used default *.onmicrosoft.com tenant domains with IT-themed names, and of the paid domains it identified in recent months about 50 percent used the .top domain and about 40 percent .com; it says display names increasingly add the target organisation's own name.

Arctic Wolf says the attackers' goal in most cases is hands-on-keyboard access through a legitimate remote tool, most often Microsoft's Quick Assist but also AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport and LogMeIn, frequently secured through a voice call from within Teams, and that victims who engage can reach payload execution in under 15 minutes. In one case it describes, the caller had the user run a PowerShell command that fetched an MSI installer from Azure Blob Storage, which unpacked a Python implant that queried Active Directory for all user and computer objects and sent the results to the attackers.

Arctic Wolf links the technique to earlier campaigns documented by Microsoft (Black Basta, Storm-1811), Sophos (STAC4749 / Chaos ransomware) and Zscaler (GoGRPC).

The Hacker News reported the research on 26 October.