Fake 'IT Support' Messages on Microsoft Teams Are Being Used to Deliver Malware and Ransomware

Researchers at Arctic Wolf Labs have described a "recurring social engineering pattern" across hundreds of cases. Attackers use the external chat feature in Microsoft Teams to impersonate IT support or to deliver malware. The cases share the same throwaway Microsoft 365 tenants, the same "IT Support (Internal)" display names, the same remote-access tools and, increasingly, the same payload domains.

The attacks often start with mail bombing, where the victim's inbox is flooded with hundreds of newsletter or subscription confirmations in a short time. This creates a false sense of urgency, and a Teams message from supposed IT support arrives soon after, offering to fix the problem. The attackers use IT-themed or friendly first-name display names to get around Teams' external-user warnings. In recent cases they have also added the target organisation's domain or company name to look more legitimate. Nearly 30 to 40 percent of the investigated cases used onmicrosoft.com domains with help desk or support-themed tenant names.

Arctic Wolf also noted a recent shift to paid domains for tenant creation. About 50 percent of those fake identities used the .top domain ending, around 40 percent used a standard .com, and just over five percent used multi-level domains such as .com.pl, .com.vn and .com.br. The activity aligns with STAC4749, which has a history of creating IT-themed cloud domains under .top. Sophos has linked these attacks to the deployment of Chaos ransomware.