Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access
Arctic Wolf Networks, Monday, October 26th, 2026
Arctic Wolf analyzes over 400 incidents where attackers abused Microsoft Teams external chat to impersonate IT support.
Arctic Wolf reviewed more than 400 incidents in which threat actors used Microsoft Teams' default-on external access to send chats impersonating IT support or deliver malicious files.
Attackers often used throwaway tenants with default onmicrosoft.com domains or paid domains, frequently .top, and display names mimicking internal IT, sometimes after email bombing the target.
Once a victim engaged, attackers typically pushed a remote management tool, most often Quick Assist, sometimes reaching payload execution in under 15 minutes.
Arctic Wolf recommends restricting Teams external access to an allow-list, blocking trial tenants, limiting unsanctioned remote-access tools, and requiring out-of-band verification.