Microsoft Teams IT Support Scams

Introduction

Recent cybersecurity research has highlighted a troubling trend of social engineering attacks that leverage Microsoft Teams' external chat creation feature. These incidents represent a recurring pattern across hundreds of cases, where threat actors have demonstrated a consistent methodology for impersonating IT support and subsequently deploying malware or ransomware within target organizations. The pattern is built on the reuse of throwaway tenant accounts and a familiar 'IT' impersonation strategy that exploits the familiarity of internal communication tools. For organizations that rely heavily on Microsoft Teams for internal collaboration, this tactic poses a significant risk, as the platform's integration with corporate infrastructure creates a bridge between seemingly legitimate external communications and the organization's internal network.

The Social Engineering Pattern

According to the analysis, the attackers follow a well-defined sequence that has become recognizable across multiple incidents. They create external chat connections through Microsoft Teams, which allows them to appear as legitimate internal users communicating with external contacts. This external chat creation feature is deliberately designed for business collaboration, making it an attractive vector for impersonation. The attackers then leverage this context to pose as IT support, impersonating the type of help desk employees that organizations already have. By establishing a false sense of familiarity and urgency, they can trick victims into disclosing credentials, downloading malicious attachments, or granting unnecessary permissions. The same throwaway tenants are repeatedly used across cases, indicating a systematic approach to maintaining cover without detection. This reuse of identities allows attackers to avoid detection by security monitoring systems that may not recognize the same account being used in different contexts.

Tactics and Delivery Mechanisms

The attack methodology centers on the external chat creation feature of Microsoft Teams, which enables users to start conversations with external contacts without requiring the same permissions or approvals as internal chat. This functionality is particularly valuable for IT professionals who need to communicate with external vendors or service providers. Attackers exploit this by crafting messages that mimic legitimate IT support communications, often referencing urgent issues or system problems that require immediate attention. Once a victim engages, the scammers can deliver malware through various vectors: malicious links that lead to phishing sites, attachments containing malware, or even legitimate-looking documents that execute code when opened. In some cases, the attackers have progressed to deploying ransomware, encrypting critical data and demanding payment for recovery. The use of throwaway tenant accounts means that each campaign can be set up quickly and discarded after use, reducing the footprint left behind and complicating forensic analysis for defenders.

Grivyonx Expert Analysis

Mitigation and Best Practices

Organizations can strengthen their defenses against these types of attacks through a combination of technical and procedural measures. First, administrators should disable or restrict the external chat creation feature where possible, or implement strict controls that require explicit approval for any external connection. Second, deploying advanced email and chat security solutions that can detect and block known malicious patterns in Teams communications is essential. These tools can identify attempts to mimic IT support language and flag suspicious links or attachments. Third, security awareness training should be updated to specifically address the Teams external chat feature and the social engineering tactics used by attackers. Employees need to be trained to verify the legitimacy of IT support requests through independent channels, such as calling the official IT help desk number rather than using contact information provided in the message. Fourth, maintaining a clean tenant inventory and regularly auditing external chat connections can help identify and remove suspicious accounts more quickly. Finally, implementing network segmentation and least-privilege access controls ensures that even if an attacker gains access to an external chat session, their ability to move laterally within the organization is limited.

Conclusion

The rise of Microsoft Teams IT support scams demonstrates how sophisticated social engineering can be executed through legitimate platform features. The recurring use of throwaway tenants and the familiar IT impersonation tactic underscore the need for organizations to treat external Teams communications with the same vigilance as traditional email or phone-based phishing attempts. By combining technical controls, such as multi-factor authentication and external chat restrictions, with robust security awareness training, organizations can significantly reduce their exposure to these evolving threats. As threat actors continue to refine their techniques, staying informed about emerging attack patterns and adapting defenses accordingly will be critical for maintaining the integrity of business communications and protecting sensitive data from malicious actors.