Microsoft Teams scams use IT impersonation to deploy ransomware

Cybersecurity researchers have identified a persistent wave of social engineering attacks targeting organizations through Microsoft Teams. Threat actors are creating fake IT support identities to trick employees into granting remote access, which ultimately leads to malware installation and ransomware deployment. This pattern, highlighted in a report by Arctic Wolf Labs shared with The Hacker News on October 26, 2026, exploits trust in internal communication channels rather than technical software vulnerabilities.

What happened

The attack vector begins with the creation of new or acquired Microsoft 365 tenants. Attackers use these tenants to generate Teams accounts with display names that mimic internal IT staff, such as "Help Desk," "IT Support," or specific names like "IT Service Desk – Liam." These accounts often use the default *.onmicrosoft[.]com domain, with tenant names chosen to sound legitimate, such as helpdeskteam365 or itcoreportal. In recent months, there has been a shift toward using paid top-level domains, with approximately 50 percent of fake identities using the .top TLD and 40 percent using .com.

Before initiating contact on Teams, attackers often flood the victim’s email inbox with hundreds of newsletter subscriptions or confirmation emails. This "mail bombing" creates a sense of urgency and confusion. Shortly after, the victim receives a Teams message from the fake IT support account offering to help resolve the email issue. This timing is designed to lower the victim's guard and make the unsolicited support offer seem helpful rather than suspicious.

Once the conversation starts, the attacker uses social engineering techniques, including voice calls (vishing), to persuade the user to install legitimate remote monitoring and management (RMM) tools like Quick Assist, AnyDesk, or TeamViewer. After gaining hands-on-keyboard access, the attacker conducts reconnaissance, moves laterally to domain controllers, and deploys additional payloads. In some cases, they instruct users to run PowerShell commands that download malicious installers from Azure Blob Storage, leading to the execution of backdoors like GoGRPC and eventually Chaos ransomware.

Key details

• Attackers use newly created Microsoft 365 tenants with IT-themed names to establish credibility in external Teams chats.
• Nearly 30–40% of investigated cases involve the use of *.onmicrosoft[.]com fallback domains to mask the origin of the messages.
• Mail bombing is used as a precursor tactic to create urgency before the fake IT support message arrives in Teams.
• Fake display names often include the target organization’s domain or common IT titles like "HelpDesk Supervisor" or "Enterprise IT & Security (Internal)."
• Attackers avoid sending direct links in Teams to bypass security scanning, instead guiding users to download payloads during remote sessions.
• The final stage of the attack often involves the deployment of Chaos ransomware after data exfiltration and lateral movement.

Background

Social engineering relies on manipulating human psychology rather than exploiting technical flaws in software. In this scenario, the attackers leverage the inherent trust employees place in internal IT departments. By mimicking the language, tone, and urgency of genuine support requests, they bypass standard security awareness training that focuses on suspicious emails or unknown links. The use of legitimate RMM tools further complicates detection, as these applications are often approved for use within organizations for genuine maintenance tasks.

Microsoft Teams allows external chat by default in many configurations, enabling users from different organizations to communicate. While this facilitates collaboration, it also opens a door for threat actors who can easily create free or low-cost Microsoft 365 accounts. The combination of external access, convincing impersonation, and the use of trusted tools creates a high-risk environment where traditional perimeter defenses may fail to detect the initial compromise.

Why it matters

For teams that manage their own software and infrastructure, this trend highlights a critical gap in security posture: identity and behavior monitoring. Traditional email filters may catch the initial mail bombing, but they cannot prevent the subsequent Teams interaction. If external chat is enabled, any employee can be targeted by a convincing impersonator. The impact is severe, as gaining remote access allows attackers to move laterally across the network, potentially compromising domain controllers and sensitive data stores.

The use of legitimate tools like RMM software makes these attacks difficult to detect with standard endpoint protection. Since the tools themselves are not malicious, security systems may not flag their installation or use. This means that telemetry from identity providers and endpoint activity logs becomes essential for detecting anomalous behavior, such as unusual remote access sessions or PowerShell commands executed by non-technical staff. Organizations must recognize that trust is now an attack surface that requires active management.

What you can do

• Restrict external chat access in Microsoft Teams to only necessary partners and vendors, disabling it for general users where possible.
• Implement strict policies for the installation and use of remote access tools, requiring approval from IT security before use.
• Train employees to verify the identity of anyone claiming to be IT support, especially if they initiate contact via chat or phone.
• Monitor for unusual spikes in email traffic (mail bombing) and correlate them with subsequent Teams messages from unknown external users.
• Enable multi-factor authentication and conditional access policies to limit the ability of compromised accounts to perform sensitive actions.
• Review and audit logs for PowerShell execution and RMM tool usage, looking for patterns that deviate from normal administrative activities.