Arctic Wolf Details Teams External-Chat Social Engineering and Payload Chain

Oct 26, 2026 · Original article ↗

Summary

Arctic Wolf analyzed 400+ incidents of attackers abusing Teams external chat for impersonation and initial access. It details a PowerShell-based payload chain and recommends restricting external access and monitoring chat and endpoint activity.

Key points

Arctic Wolf analyzed more than 400 incidents involving abuse of Microsoft Teams external chat for social engineering and initial access; the activity abuses a legitimate feature, not a known Teams vulnerability.
Attackers impersonated IT support using external tenants and convincing display names. Some cases involved email bombing followed by Teams outreach or vishing.
Attackers commonly sought access through Quick Assist or other remote monitoring and management tools; Arctic Wolf says activity could progress from user engagement to payload execution in under 15 minutes.
In a detailed example, a user-launched PowerShell command downloaded an MSI containing an obfuscated script and archive. The resulting implant queried Active Directory and sent information to C2 endpoints.
Arctic Wolf identifies the Teams ChatCreated event as an opportunity to detect suspicious first contact before a user engages, and recommends correlating it with email, identity, and endpoint telemetry.
Recommended defenses include limiting external Teams access to trusted organizations, blocking trial tenants and unmanaged accounts, restricting unauthorized remote-access tools, and verifying support requests through a separate trusted channel.

Article Details

Attack Vectors: Attackers used external Microsoft Teams one-to-one chats from newly created or acquired tenants to impersonate internal IT support.
In some reported cases, an inbox flood of newsletter or subscription confirmations preceded the Teams contact, creating urgency and obscuring legitimate email.
Attackers used Teams voice calls (vishing) to persuade victims to install or run remote-access software, including Quick Assist and other RMM tools.
In an observed infection chain, the attacker instructed a victim to run a PowerShell command and launch a downloaded file. PowerShell retrieved an MSI from Azure Blob Storage; the MSI dropped and executed an obfuscated PowerShell script that decrypted and ran a loader, which extracted a Python interpreter and implant from a bundled ZIP archive.
The implant queried Active Directory for computer and user objects and sent the collected information to C2 endpoints selected from domains and URIs embedded in its code.
Defensive Notes: Restrict Teams external access to an allow-list of trusted organizations; block unmanaged or consumer accounts and federation with trial-only tenants where appropriate.
Monitor Teams ChatCreated events, especially chats from unfamiliar tenants or contacts using IT-support names, and correlate them with email-bombing, endpoint, identity, domain, and remote-access telemetry.
Restrict Quick Assist to authorized IT roles and block or remove unsanctioned RMM tools; alert on unauthorized RMM execution and investigate follow-on reconnaissance.
Require out-of-band verification for remote-access requests, such as a callback to a registered number or approval through a separate trusted application.
Train staff to verify the External label and sender domain, treat unsolicited IT-support chats as suspicious, and retain first-contact and Safe Links warnings.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`fix-it[.]top`	Named as a cheap disposable .top domain used in the reported payload-staging and C2 infrastructure shift.
DOMAIN	`get-help-systems[.]top`	Named as a cheap disposable .top domain used in the reported payload-staging and C2 infrastructure shift.
DOMAIN	`getitconnect[.]top`	Named as a cheap disposable .top domain used in the reported payload-staging and C2 infrastructure shift.
DOMAIN	`getsysmonitor[.]top`	Listed as attacker infrastructure themed as an update domain for payload and C2 activity.
DOMAIN	`ggc[.]com[.]ph`	Listed among repeatedly observed payload or credential-phishing domains.
DOMAIN	`help-desk-get[.]top`	Named as a cheap disposable .top domain used in the reported payload-staging and C2 infrastructure shift.
DOMAIN	`helpdesk-call[.]com`	Listed as a help-desk lookalike domain used as impersonation infrastructure.
DOMAIN	`helpdesk-s1x[.]com`	Listed as a help-desk lookalike domain used as impersonation infrastructure.
DOMAIN	`helpdesk-support-office-3[.]com`	Listed as a help-desk lookalike domain used as impersonation infrastructure.
DOMAIN	`helpdesk-support-office-4[.]com`	Listed as a help-desk lookalike domain used as impersonation infrastructure.
DOMAIN	`helpdesk-support-us-ny[.]com`	Listed as a help-desk lookalike domain used as impersonation infrastructure.
DOMAIN	`helpdesk-support-us3[.]com`	Listed as a help-desk lookalike domain used as impersonation infrastructure.
DOMAIN	`helpdesk-sys[.]top`	Named as a cheap disposable .top domain used in the reported payload-staging and C2 infrastructure shift.
DOMAIN	`helpdeskteam365[.]onmicrosoft[.]com`	Fake attacker tenant domain observed across intrusions and used to establish an external Teams identity.
DOMAIN	`infoupdate-it[.]top`	Listed as attacker infrastructure themed as an update domain for payload and C2 activity.
DOMAIN	`it-seccontrol[.]top`	Listed as attacker infrastructure themed as an IT/security domain for payload and C2 activity.
DOMAIN	`itcoreportal[.]onmicrosoft[.]com`	Fake attacker tenant domain observed across intrusions and used to establish an external Teams identity.
DOMAIN	`itdeskassist[.]com`	Listed as a help-desk lookalike domain used as impersonation infrastructure.
DOMAIN	`itendpoint365[.]onmicrosoft[.]com`	Fake attacker tenant domain observed across intrusions and used to establish an external Teams identity.
DOMAIN	`kilan[.]com[.]pl`	Listed among repeatedly observed payload or credential-phishing domains.
DOMAIN	`networkadmin797[.]onmicrosoft[.]com`	Fake attacker tenant domain observed across intrusions and used to establish an external Teams identity.
DOMAIN	`programupdate-assis[.]top`	Listed as attacker infrastructure themed as an update domain for payload and C2 activity.
DOMAIN	`saludcentro[.]gov[.]co`	Listed among repeatedly observed payload or credential-phishing domains.
DOMAIN	`scapini[.]com[.]br`	Listed among repeatedly observed payload or credential-phishing domains.
DOMAIN	`sec-check-it[.]top`	Listed as attacker infrastructure themed as an update domain for payload and C2 activity.
DOMAIN	`supportedge33[.]onmicrosoft[.]com`	Fake attacker tenant domain observed across intrusions and used to establish an external Teams identity.
DOMAIN	`supportedge39[.]onmicrosoft[.]com`	Fake attacker tenant domain observed across intrusions and used to establish an external Teams identity.
DOMAIN	`sys-update-check[.]top`	Listed as attacker infrastructure themed as an update domain for payload and C2 activity.
DOMAIN	`techrelay[.]top`	Listed as attacker infrastructure for payload and C2 activity.
DOMAIN	`update-software[.]top`	Listed as attacker infrastructure themed as an update domain for payload and C2 activity.