Microsoft is adding AI-based phishing detection to Teams after attackers repeatedly used external chats to impersonate support staff, send malicious files, and deliver fake billing notices. The reported attacks exploit Teams' default external-access feature rather than a software flaw, making employees the key line of defense.
Attackers have repeatedly used Microsoft Teams' external chat feature to make first contact with employees. In some cases, they posed as technical-support workers offering to help with an account issue, prompting the target to engage with an unsolicited support chat. In other cases, researchers observed scam guest invitations containing false billing and subscription notifications designed to look as though they came from a genuine Microsoft user. A third pattern involved external users sending suspicious files through newly created chats after establishing a thin veneer of trust.
Researchers at Arctic Wolf studied more than 400 incidents involving this kind of external-chat creation, used either for impersonation scams or to deliver suspicious files. Sophos and Check Point reported similar activity, including fake tech-support contacts and billing-themed guest invitations.
These attacks do not rely on a software flaw. They abuse a legitimate, default-on collaboration capability: Teams' external federation, which allows outside users to initiate chats with employees. Because the feature is enabled by default and widely used for legitimate cross-organization collaboration, an external first-contact message can appear routine rather than suspicious, especially when it imitates a familiar role like IT support or references a plausible billing issue.
Organizations and employees can reduce exposure by treating unexpected external Teams chats as untrusted by default, especially when the sender claims to represent support staff or a trusted vendor. Billing or subscription alerts delivered through guest invitations should be verified through a known company or Microsoft channel rather than acted on directly. Files and links from unverified external senders should not be opened without independent confirmation of the sender's identity. Finally, employees should report suspicious Teams messages, files, or invitations even when they appear to originate from a real organization, since attackers are exploiting legitimate platform features rather than a technical weakness.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers use Teams' default-on external federation feature to start first-contact chats, posing as technical support workers or genuine Microsoft users to send malicious files or false billing notifications.
No. The activity does not exploit any known Teams vulnerability; it abuses a legitimate, default-on collaboration capability that allows external users to initiate chats.
Warning signs include unsolicited messages from unknown external senders, requests from supposed support staff who contact you out of the blue, and billing or subscription alerts delivered through guest invitations rather than verified channels.
Treat unexpected external Teams chats as untrusted, verify billing or support claims through known channels, avoid opening files from unverified senders, and report suspicious messages.
“Hi, I’m from technical support.” In Teams? Hold on. Teams lets outside users start chats by default. Someone posing as support can ask you to open a file. Or a guest invite can claim, “Your billing or subscription requires attention.” Here’s the catch: it’s a real Teams feature, not a Teams bug. A familiar-looking name doesn’t make an unknown external sender your IT team. Before you reply, open any file, or act on that bill, check with your company’s known support channel.
Attackers are using Microsoft Teams external chat to pose as internal IT support staff, often after overwhelming employees with email subscription messages. They persuade victims to join a voice call, approve remote-control tools, or run commands, with some incidents ending in malware infections…
Attackers are posing as internal IT support staff in Microsoft Teams, often after flooding an employee’s inbox with subscription emails to create urgency. They persuade victims to grant remote access through legitimate support tools, then install malware, steal information, and in some cases deploy…
Attackers overwhelm employees with hundreds of spam messages, then contact them through Microsoft Teams while posing as internal IT support. They offer to fix the inbox problem, move victims into a voice call, and persuade them to install or use remote-access tools such as Quick Assist. The scams…
A weekly threat bulletin highlights a North Korea–linked campaign where attackers posed as AI or blockchain employers to trick IT professionals into getting infected and losing cryptocurrency. It also notes a phishing kit that abuses Microsoft’s legitimate device login flow to gain long-lasting…
Researchers say the Iran-linked group Nimbus Manticore posed as recruiters on LinkedIn and job platforms to send developers “technical challenge” ZIP files that secretly installed cross-platform remote access trojans. The lures used urgency (short test windows) and realistic developer workflows…
This news roundup describes multiple real-world social engineering operations, including a device-code phishing service that stole access to over 12,000 inboxes and a North Korean campaign posing as recruiters to trick developers during fake coding interviews. The attackers used legitimate login…
