NEWS

Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware

Arctic Wolf sees a repeating pattern across hundreds of cases: mail flooding, a fake IT help desk on Teams, then an RMM tool install and ransomware.

Dylan H.

News Desk

October 26, 2026
2 min read
Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware

Overview

Researchers are calling attention to a "recurring social engineering pattern" across hundreds of cases in which attackers use Microsoft Teams' external chat feature to impersonate IT support and deliver malware. Arctic Wolf notes that the technique "exploits trust rather than a software vulnerability."

Attack Chain

  1. Mail flooding. The victim's inbox is flooded with newsletter or subscription confirmations, creating urgency.
  2. Teams contact. A message from a fake "IT support" identity arrives offering to fix the problem. It comes from a throwaway Microsoft 365 tenant with an IT-themed display name.
  3. Remote access. The victim is talked into installing a legitimate remote monitoring and management (RMM) tool. In one case, they were told to run a PowerShell command that pulled an MSI installer from Azure Blob Storage.
  4. Post-compromise. Attackers run reconnaissance, move toward domain controllers, add redundant RMM tools, steal data and deploy ransomware.

About 30–40% of cases use *.onmicrosoft.com fallback domains with help-desk-style names. Recent cases use paid domains, mostly .top, and some add the target company's name to the display name. Attackers avoid pasting URLs into Teams, which would trigger Safe Links scanning, so message scanning alone can miss them.

Tools and Malware Observed

  • Ransomware: Chaos ransomware, per Sophos
  • Backdoors: a GoGRPC backdoor, a Python implant launched by a PowerShell script, and an MSI component that runs LDAP queries against Active Directory and sends the results out
  • RMM tools abused: Quick Assist, AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport, LogMeIn and Level

The activity aligns with the cluster STAC4749, which has a history of creating IT-themed cloud domains under the .top TLD and using plausible employee usernames.

Defensive Recommendations

  • Review whether external Teams access is needed, and restrict it to allow-listed tenants where possible.
  • Monitor endpoint and identity telemetry, not just messages: watch for unexpected RMM installs and sessions, PowerShell download-and-execute, and unusual Active Directory enumeration.
  • Block or allow-list RMM tools so only your approved one can run.
  • Train staff to treat unsolicited "IT support" contact, especially right after a burst of spam email, as suspicious, and to verify through a known channel before granting remote access.

Sources