{"id":3786,"date":"2026-10-26T19:13:46","date_gmt":"2026-10-26T19:13:46","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3786"},"modified":"2026-10-26T19:13:46","modified_gmt":"2026-10-26T19:13:46","slug":"attackers-use-microsoft-teams-it-support-scams-to-deploy-malware-and-ransomware","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3786","title":{"rendered":"Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware"},"content":{"rendered":"
\n
<\/a><\/div>\n

Cybersecurity researchers are calling attention to what they say is a \u00abrecurring social engineering pattern\u00bb across hundreds of cases in which threat actors use Microsoft Teams’ external chat creation feature to conduct impersonation scams or to deliver malware.<\/p>\n

\u00abA consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same ‘IT Support (Internal)’ display names, the same remote-access tools, and increasingly, the same payload domains,\u00bb Arctic Wolf Labs said<\/a> in a report shared with The Hacker News.<\/p>\n

The attacks consistently employ IT-themed display names or friendly-sounding first names to subvert external-user warnings in Teams. These messages originate from Teams identities established through newly created or acquired Microsoft 365 tenants.<\/p>\n

Nearly 30\u201340% of the cases investigated by the cybersecurity company involve the use of *.onmicrosoft[.]com<\/a>, a permanent fallback domain automatically generated by Microsoft when a Microsoft 365 tenant is created. These domains masquerade as IT infrastructure, opting for a help desk- or support-themed word as the tenant name to increase their credibility – <\/p>\n