Arctic Wolf warns of Teams impersonation campaign targeting employees

Cybersecurity researchers at Arctic Wolf warn that attackers are impersonating IT support through Microsoft Teams as part of an ongoing campaign. The researchers observed the pattern in more than 400 cases.

In the reported attacks, an employee first receives hundreds or possibly thousands of spam emails in a short time, flooding the inbox. The same entity then contacts the employee through Teams, posing as an “IT Service Desk” account and offering help with the email problem. It may also call through Teams.

The impostors ask for hands-on device access, often by having the employee open Quick Assist, a tool built into Windows, and share a six-digit code. Arctic Wolf says attackers have then installed commercial remote-management tools such as AnyDesk or ScreenConnect to maintain another route to the device. They also mapped the target’s IT network and conducted reconnaissance, potentially ahead of a malware or ransomware attack.

Arctic Wolf says the campaign abuses Teams’ default-on external access, which can allow messages between Microsoft 365 accounts in different tenants. The researchers say this is a legitimate collaboration feature, not a known Teams vulnerability. They recommend organizations replace “allow all” external chat with an allow-list of trusted organizations and remind employees that Teams messages and calls, like email, are not automatically legitimate.