Teams Help Desk Impersonation: A Mail Flood and an External Chat That Talk Employees Into Remote Access

Attackers bury an inbox in subscription emails, then pose as IT support in a Microsoft Teams external chat to get a remote-access session, in more than 400 incidents Arctic Wolf analysed.

The sequence starts in email and moves out of it. Hundreds of newsletter confirmations arrive within minutes; a chat from an outside tenant with a name such as "IT Support" follows moments later and offers to fix the problem the flood just created. The attackers do not exploit a flaw in Teams. They use external access, a setting that is on by default, and a persuasion sequence built around the inbox flood.

How does Microsoft Teams external chat IT support impersonation work?

An attacker creates or buys a Microsoft 365 tenant, gives it an IT-themed name, and uses Teams external access to message an employee at another organisation. Arctic Wolf describes a consistent pattern across the incidents: the same kinds of throwaway tenants, the same "IT Support (Internal)" style of display name, the same remote-access tools and, increasingly, the same payload domains.

The inbox flood comes first

In a significant number of cases, customers reported that the Teams contact was preceded or accompanied by mail bombing: hundreds of newsletter or subscription confirmations within minutes. Arctic Wolf says the storm is meant to manufacture urgency and to bury legitimate email such as security alerts. The "IT support" message then arrives moments later and offers to fix the very problem the attacker just created.

The chat arrives as an external user with an internal-sounding name

Teams labels the sender as external, but the display name is built to cancel that warning. Arctic Wolf reports that attackers append "(Internal)" to the display name so that the recipient sees an internal IT sender while Teams simultaneously shows the External tag. In recent cases the attacker also puts the target organisation's own name or domain in the display name. The first contact is a one-on-one chat, which avoids the visibility of a group conversation.

Why the chat needs no exploit

Teams external access, also called federation, lets a user in one Microsoft 365 tenant find, chat with and call users in another tenant when both tenants allow it. Microsoft's documentation states that the organisation setting and user policies are on by default, and that the default domain setting is "Allow all external domains". Arctic Wolf treats this default as the feature attackers most often abuse. Employees are generally trained to distrust email, so a message that appears inside the company's own collaboration tool does not carry the same learned caution.

What do the fake IT identities look like?

The identities follow a pattern that is visible in the research even though each tenant is short-lived.

Tenant names and domains

Between 30 and 40 percent of the cases involved a default *.onmicrosoft[.]com tenant, which needs no verification and can be provisioned within minutes. Arctic Wolf assesses that attackers pick a support-, IT-, admin-, network- or helpdesk-themed word for the tenant name, optionally suffixed with 365, "online", "portal" or a random number. In a smaller number of cases they used legitimate company names in the tenant name. The full tenant list is under Indicators below.

Arctic Wolf also reports a recent shift toward paid domains. Of the paid domains identified in these scams over the past few months, approximately 50 percent of the fake identities used the .top suffix, around 40 percent a standard .com, and just over 5 percent multi-level domains such as .com.pl, .com.vn and .com.br. In a subset of these custom domains, attackers configured DNS to redirect web requests to the real Microsoft or victim-organisation site to look authentic.

Display names

Names that Arctic Wolf observed most frequently include "Help Desk", "IT Support", "HelpDesk Manager" and "HelpDesk Supervisor". Others pair a department label with a friendly first name, for example "IT Service Desk (Liam)". Arctic Wolf also saw region-specific names tailored to the target's locale, such as "Supporte TI", and roughly 100 or more names with emoji markers such as a shield or a wrench. Arctic Wolf says this may be evidence of AI used to create the identities; it is a hedge, not a finding.

What happens after the employee answers?

Arctic Wolf assesses that the attacker's immediate goal in most cases is hands-on-keyboard access through a legitimate remote monitoring and management tool. Chat creation is only the entry point.

Quick Assist first, a second tool for persistence

Attackers also frequently use vishing, a direct voice call from inside Teams, to get the tool installed. The most commonly observed tools were Quick Assist, AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport and LogMeIn. Quick Assist is the most frequent. Arctic Wolf suggests that this may be because it is built into Windows, signed by Microsoft, needs no installation and only requires the victim to read back a six-digit code. When attackers want persistence beyond the first call, they pivot to a commercial tool, or to a second platform such as Level installed with msiexec, which gives an independent control channel that survives removal of the first.

One documented case: PowerShell, an installer and a Python implant

Arctic Wolf describes a potentially novel chain in which the attacker had the victim run a PowerShell command and launch the downloaded file, both under the victim's account with explorer.exe as the parent process. The command downloaded an MSI installer from Azure Blob Storage that bundled a PowerShell script and an archive named archive6.zip. About 30 seconds after the installer launched, the script cleaner.ps1 was dropped into the user's AppData folder and ran. It decoded and ran a loader that extracted a Python interpreter and an implant, ss.py. The implant issued LDAP queries to Active Directory for all computer and user objects and sent the results to a command server picked at random from a list in its code.

The chain is fast

Attackers commonly target multiple users within windows of about five minutes, which Arctic Wolf thinks points to automation. The customer-reported chains reach payload execution in under 15 minutes from the point the victim engages. In several cases, credential-access detections tied to Kerberoasting and GoldenPAC fired alongside the first Teams alert, so the endpoint was already compromised by the time the chat alert was triaged.

How can organisations detect and stop fake IT support in Teams?

The controls that hold up do not depend on the display name or on a particular tenant. Arctic Wolf and the outlets that relay its report point to four layers.

Why standard controls miss it

The first contact is a chat inside Teams, not a mail flow, and the account behind it belongs to a real Microsoft 365 tenant, new or purchased, not a spoofed address. Arctic Wolf reports that attackers generally avoid pasting a URL into Teams, which would trigger Safe Links and ZAP scanning, and navigate to the payload themselves during the remote session. Link scanning therefore has nothing to scan, and Arctic Wolf concludes that endpoint and identity telemetry are essential surfaces alongside message scanning.

The tools that follow are legitimate software, not malware. The structural gap is that each control watches one surface (the inbox, the chat or the endpoint) and the attack uses all three in sequence (AegisAI's own reading). The email defence sees spam, not the chat that follows it.

How AegisAI protects against it

This is AegisAI's own reading. The reporting places the first contact in Teams, outside email, so an email control has the flood and anything that follows by mail, not the chat itself. The paragraphs below describe the email layer only.

Aegis does not classify infrastructure. It classifies intent. A lure with no attacker-owned infrastructure still has to ask the recipient to do something on the attacker's behalf, and that request is what gets classified, independent of how clean the destination URL is.

When a lure or a compromised session is caught, the response compounds: the message is withheld at classification, copies already delivered are retracted, rewritten links refuse a late visit, the account's outbound and internal mail gets rescanned, and lateral phishing attempts to colleagues are blocked at the same bar rather than treated as a fresh, unrelated message.

More on how that works: inbound email security.

What the reporting does not tell us

Outcomes. Arctic Wolf analysed more than 400 incidents but does not say how many reached full compromise, data theft or ransomware. Its own technique table notes that hands-on execution was confirmed only in the few events where the user engaged, and its alerts most often fire before that. Help Net Security reports that some intrusions ended with data theft and ransomware, without a count.

Attribution. The researchers did not identify who is behind the incidents. They note that the technique dates to mid-2024 Black Basta activity and has since appeared in Cactus, 3AM and Chaos ransomware operations.

Mail-bombing prevalence. The flood is described as present in "a significant number of cases". No percentage is given, so the share of incidents that begin in the inbox is unknown.

The 15-minute figure. It comes from chains that customers reported, not from all 400 incidents, and the report does not say how many chains that is.

File delivery in chat. Arctic Wolf says some incidents deliver malicious files, not only impersonation, but gives no count and no detail beyond the documented PowerShell case.

Indicator lifespan. The tenant names and domains describe what Arctic Wolf saw through October 2026. A new free tenant takes minutes to create, so a specific name is likely to be short-lived even if the naming pattern persists.

Indicators published in the primary research

Arctic Wolf published these in its appendix. They are copied from the appendix, written with [.] so they cannot be clicked, and best used as historical context, not a live blocklist. AegisAI left out four domains that Arctic Wolf lists as "payload or credential-phish domains seen repeatedly", because at least one is a government suffix and may be a compromised legitimate site.

MITRE ATT&CK mapping

This mapping is AegisAI's own reading of the reported behaviour. Arctic Wolf publishes its own table, which uses T1656 for impersonation; that technique now redirects to T1684.001 on the ATT&CK site.

Recommendations for defenders

FAQ

References