Arctic Wolf Warns Hackers Use Microsoft Teams to Impersonate IT Support

Arctic Wolf described a consistent pattern across the cases. An employee receives hundreds or possibly thousands of spam emails in a short period, burying legitimate messages. Shortly afterward, the same person receives a Microsoft Teams message from an account that appears to belong to the IT service desk, sometimes with a first name attached. The sender says the IT department knows about the email problems and offers to fix them. The same entity is behind both the spam and the Teams contact, according to Arctic Wolf. In some cases, the attacker calls the victim through Teams instead of sending a message.

To resolve the purported problem, the attacker asks for hands-on access to the victim’s keyboard, typically through AnyDesk or ScreenConnect. In many cases, the attacker instead asks the employee to open Quick Assist, a tool built into Windows, signed by Microsoft and requiring no installation. The victim only needs to provide a six-digit code to grant access, the report said.

The scheme relies less on a software flaw than on a legitimate feature. Microsoft Teams ships with external access, also called federation, turned on by default, meaning employees can receive messages from anyone with a Microsoft 365 account, including users in another organization’s tenant, unless IT changes the setting. Arctic Wolf said the activity does not exploit a known Teams vulnerability and instead abuses a default-on collaboration capability. “This is the feature attackers most frequently abuse,” Arctic Wolf said, according to the report. “This activity does not exploit any known Teams vulnerability; it abuses a legitimate, default-on collaboration capability.”

After gaining access, the researchers saw attackers install a commercial remote monitoring and management tool such as AnyDesk or ScreenConnect to create a separate control channel. That step could let them retain access even if the Quick Assist session is revoked, the report said. The attackers then mapped the target IT network and conducted reconnaissance, likely in preparation for a ransomware or malware attack.

Arctic Wolf recommended that organizations restrict Teams external chat from “allow all” to an allow-list of trusted organizations, citing Microsoft guidance. “Most organizations have no legitimate need for open, any-tenant external chat,” Arctic Wolf said, according to the report. It also said employees should be taught that a message, call or email appearing to come from IT support is not proof of legitimacy.