Threat Intelligence

Fake Teams Chats Used to Deliver Malware in Minutes

Dark Reading · 28 Oct 2026

Key Takeaway Restrict or tightly control external Teams chats, and train staff to verify unexpected contacts, especially anyone offering urgent help, before they click or install anything.

Dark Reading reports on a wide-scale, ongoing social engineering campaign that uses external Teams chats to deliver malware within about 15 minutes. The report says the activity may be tied to the Black Basta ransomware gang.

The campaign appears to build on an older tactic known as "mail bombing", where a target is flooded with unwanted messages. The summary describes this as getting a new look, with attackers now using external chats in Microsoft Teams as the anchor for the attack.

The feed summary does not provide further detail, so the full technical breakdown is best read in the original Dark Reading article. The key point for business owners is that messages arriving through collaboration tools, including from people outside your organisation, can be part of a ransomware-linked attack and should not be trusted by default.

Microsoft Teams Social Engineering Black Basta Ransomware Malware

Summarised by CISO AI from Dark Reading, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.