# Arctic Wolf counts 400-plus fake IT help desk intrusions over Teams external chat

Source: https://startwithidentity.com/blog/2026-10-26-arctic-wolf-counts-400-fake-it-help-desk-intrusions-over-teams-external-chat/
Last updated: 2026-10-26
License: content by Start with Identity. Cite the source URL.

---

Arctic Wolf Labs published an analysis on October 26 of more than 400 incidents in which attackers abused Microsoft Teams external chat for initial access. The pattern starts with an inbox flood of newsletter and subscription confirmations; minutes later the attacker messages the employee on Teams posing as IT support. Teams external access is open by default, and 30 to 40 percent of cases came from free `onmicrosoft.com` tenants, with display names like "IT Service Desk (Matthew)" or an "(Internal)" suffix. Recent cases shifted to paid domains, about half of them `.top`. Quick Assist was the most common tool, with the victim reading back a six-digit code, followed by AnyDesk, ScreenConnect and TeamViewer. Attackers often contacted several users within about five minutes, and some reached payload execution in under 15 minutes. Microsoft first described the technique in 2024, linked to Black Basta.

## Why it matters

This is [help desk social engineering](https://startwithidentity.com/techniques/help-desk-social-engineering/) run in reverse: the attacker plays the help desk, and the employee grants the session. No credential is stolen, MFA is never challenged, and the remote session runs as the user on a trusted device, so identity telemetry shows nothing unusual.

Move Teams external access from "allow all" to an allow-list of partner domains, and block unmanaged Teams accounts and trial tenants. Restrict Quick Assist to IT roles or remove it, and block unsanctioned RMM tools. Publish how your real IT team contacts staff and require an out-of-band callback to a registered number before anyone grants remote access. Alert on the Teams ChatCreated event from external tenants and correlate it with remote-tool launches.

Source: [Arctic Wolf](https://arcticwolf.com/resources/blog/threat-actors-abuse-microsoft-teams-external-chat-for-initial-access/)