Arctic Wolf counts 400-plus fake IT help desk intrusions over Teams external chat
Arctic Wolf Labs said on October 26 it analyzed more than 400 incidents where attackers flooded an inbox with spam, then messaged the employee on Microsoft Teams as IT support and talked them into Quick Assist. Some reached code execution within 15 minutes.
Arctic Wolf Labs published an analysis on October 26 of more than 400 incidents in which attackers abused Microsoft Teams external chat for initial access. The pattern starts with an inbox flood of newsletter and subscription confirmations; minutes later the attacker messages the employee on Teams posing as IT support. Teams external access is open by default, and 30 to 40 percent of cases came from free onmicrosoft.com tenants, with display names like "IT Service Desk (Matthew)" or an "(Internal)" suffix. Recent cases shifted to paid domains, about half of them .top. Quick Assist was the most common tool, with the victim reading back a six-digit code, followed by AnyDesk, ScreenConnect and TeamViewer. Attackers often contacted several users within about five minutes, and some reached payload execution in under 15 minutes. Microsoft first described the technique in 2024, linked to Black Basta.
Why it matters
This is help desk social engineering run in reverse: the attacker plays the help desk, and the employee grants the session. No credential is stolen, MFA is never challenged, and the remote session runs as the user on a trusted device, so identity telemetry shows nothing unusual.
Move Teams external access from "allow all" to an allow-list of partner domains, and block unmanaged Teams accounts and trial tenants. Restrict Quick Assist to IT roles or remove it, and block unsanctioned RMM tools. Publish how your real IT team contacts staff and require an out-of-band callback to a registered number before anyone grants remote access. Alert on the Teams ChatCreated event from external tenants and correlate it with remote-tool launches.
Source: Arctic Wolf
Related on Start with Identity
- BlogDevice code phishing industrialises: 25 kits, and Microsoft counts new campaigns daily
The OAuth device authorization flow built for smart TVs is now a phishing-as-a-service product line. Microsoft reported 10 to 15 new campaigns every 24 hours by
- BlogRecruitTrap ran 3,000 fake recruitment logins with browser-in-the-browser popups and live MFA relay
CTM360 found over 3,000 phishing URLs impersonating recruiters at 50-plus organizations across 14 sectors. The pages fake a browser window, complete with addres
- BlogAttackers are phoning employees about their passkeys, then enrolling their own MFA method
Microsoft detailed a campaign running since May 2026 in which callers posing as IT tell US enterprise users to update their passkey or MFA settings, route them
- BreachScattered Spider and the help desk: social engineering the identity reset
Scattered Spider showed that the fastest way past strong authentication is often a phone call to the help desk. Here is the pattern and how to close it.
- PodcastEntra.Chat
A weekly show for Microsoft Entra administrators, with deployment stories from practitioners and the engineers who build the product. Hosted by a Microsoft empl
- PodcastKuppingerCole Analyst Chat
Weekly conversations between KuppingerCole analysts on identity architecture, governance, AI agents, and the market. Over 300 episodes since 2020.