Arctic Wolf Warns of Microsoft Teams External Chat Abuse
Summary
Arctic Wolf says attackers abuse Microsoft Teams’ default-on external chat to impersonate IT support or company staff and exploit employee trust. Its review of about 400 cases found attackers used default tenant domains and paid domains.
Key points
- Teams external access is on by default and allows users to contact other Microsoft 365 users who also have the feature enabled, even across organizations.
- Arctic Wolf says the activity abuses a legitimate Teams capability rather than exploiting a known Teams vulnerability.
- In about 30–40% of the roughly 400 cases reviewed, attackers used default tenant domains such as yourcompany[.]onmicrosoft[.]com.
- Among paid domains, Arctic Wolf reported that [.]top appeared in about 50% of cases and [.]com in about 40%.
- Attackers used wording that made them appear to be external IT support or spoofed the target company to gain employees’ trust.
Article Details
- Event Type
- Reported abuse of Microsoft Teams external chat for social engineering and network access
- Impact
- Arctic Wolf reports that attackers exploit trust through Teams’ external chat feature to gain access to company networks and download malware. The activity abuses a legitimate default-on capability, not a known Teams vulnerability. In its analysis of about 400 cases, Arctic Wolf found that 30–40% used the default .onmicrosoft.com domain; among paid domains, it reported .top in about 50% of cases and .com in about 40%.