Phishing

On October 26, Arctic Wolf Labs published an analysis of more than 400 incidents that started the same way. An employee's inbox fills with hundreds of newsletter and subscription confirmations within minutes. Moments later a Microsoft Teams chat arrives from "IT Support (Internal)" offering to fix it. The caller talks the employee into a remote session, and in customer reports the attacker's code was running less than 15 minutes after the victim engaged.

No Teams vulnerability is involved. The attack works in any Microsoft 365 tenant that leaves Teams external access at its default, which lets users in any other organization start a one-to-one chat with your staff. Several of these intrusions moved on to domain controllers, data theft and ransomware, so this is a configuration change worth making this week.

How it works

Teams external access (federation) lets your users chat with people in other Microsoft 365 tenants. Out of the box it allows every external domain, so anyone who creates a tenant can search for a user's address and open a chat. Teams marks such a sender as External, but the display name is whatever the attacker types.

Arctic Wolf found that 30 to 40 percent of cases used a free *.onmicrosoft.com tenant, which needs no domain verification and takes minutes to create. Tenant names in the appendix include helpdeskteam365, itendpoint365 and corporateitservicellc. Where the attackers paid for a domain, about half were .top, about 40 percent .com and just over 5 percent multi-level domains such as .com.pl and .com.br. Display names follow a pattern: "Help Desk", "IT Service Desk - Liam", names with "(Internal)" appended to override the External tag in the reader's mind, and recently the target company's own name. More than 100 of them included emoji, which Arctic Wolf thinks may point to generated identities.

The email bomb does two jobs. It gives the victim a real problem that "IT" can plausibly be calling about, and it buries any genuine security alert in the noise. Several users at one company are usually contacted within about five minutes, which suggests automation.

The chat then becomes a voice call. The goal is a remote session through a legitimate tool, most often Quick Assist, which ships with Windows and only needs the victim to type a six-digit code. AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport and LogMeIn also appear. The attackers avoid pasting links into Teams, because Safe Links and zero-hour auto purge (ZAP) would scan them. They browse to the payload themselves once they have the screen.

What the attackers do next

In the case Arctic Wolf took apart, the victim was told to run a PowerShell command. It pulled an MSI installer from Azure Blob Storage, so the download came from a Microsoft domain. The MSI dropped cleaner.ps1 into AppData\Local\PowershellCleaner\scripts, which decoded and decrypted a loader that unpacked a pythonw interpreter and an implant called ss.py from archive6.zip. The implant queried Active Directory for every user and computer object and sent the names and descriptions to the attacker's servers. In several incidents, Kerberoasting and other credential-access alerts fired at the same time as the first Teams alert.

From there the reported intrusions installed a second remote management tool, Level, as a backup way in, deployed the GoGRPC backdoor, moved to domain controllers, took data and in some cases dropped ransomware. Arctic Wolf does not name one actor. The playbook goes back to Black Basta (Microsoft's Storm-1811) in mid-2024, has since been used by Cactus and 3AM ransomware affiliates, and matches STAC4749, a group Sophos tied to Chaos ransomware. Sophos saw STAC4749 hit dozens of North American organizations between February and June 2026, with at least three intrusions ending in encryption and one taking under 17 hours from first chat to ransomware.

What to do

1. Restrict external access to the domains you work with. In the Teams admin center, go to Users, then External access, and choose "Allow only specific external domains". Add your partners and suppliers. The PowerShell equivalent is Set-CsTenantFederationConfiguration -AllowedDomainsAsAList with a list of domains. Most staff never need to chat with an unknown tenant, and this one setting removes the throwaway-tenant route entirely.
2. If you cannot allow-list yet, cut the cheapest sources. Block chats with unmanaged (personal) Teams accounts with -AllowTeamsConsumer $False, or at least -AllowTeamsConsumerInbound $False so they cannot start the conversation. Confirm -ExternalAccessWithTrialTenants is Blocked with Get-CsTenantFederationConfiguration. Then set -SecurityTeamAllowBlockListDelegation Enabled so your security team can block a reported domain from the Tenant Allow/Block List in Microsoft Defender without waiting for a Teams admin.
3. Take away the remote tool. If your help desk uses something else, uninstall Quick Assist with Get-AppxPackage -Name MicrosoftCorporationII.QuickAssist | Remove-AppxPackage -AllUsers, or block remoteassistance.support.services.microsoft.com at the proxy. Blocking that endpoint also breaks Intune Remote Help, which Microsoft recommends over Quick Assist for in-tenant support. Block or remove AnyDesk, TeamViewer, ScreenConnect, Atera, Level and Splashtop wherever they are not your sanctioned tool, using application control or Defender for Endpoint.
4. Tell staff how your real IT team contacts them, and that a Teams message marked External is never internal IT, whatever the name says. Any request for remote access gets a callback to a number from the directory before anyone types a code.

Check whether it already happened. Arctic Wolf names the ChatCreated audit event, which records the first one-to-one chat from an external tenant, as the earliest point to catch this. Search the Microsoft Purview audit log for ChatCreated with external participants over the last 90 days and look for unknown tenants, IT-themed names and several of your users contacted within minutes. In Defender advanced hunting, look in DeviceProcessEvents for QuickAssist.exe or an RMM installer started shortly after a mail flood, pythonw.exe running from a user's AppData, and any path containing PowershellCleaner. Check DNS and proxy logs against the domains in Arctic Wolf's appendix, such as update-software.top, sec-check-it.top and helpdesk-call.com.

If you find a session, treat the machine as attacker-controlled. Isolate it, remove every remote tool the attacker installed (look for a second one; Level was the backup in these cases), reset the user's password and revoke their sessions. Because the implant read all of Active Directory and Kerberoasting alerts followed, rotate passwords on service accounts that have a service principal name, and review domain controller logons from the affected host.

The wider lesson

Teams, Slack and similar tools are now a phishing channel that most mail filters never see, and their federation defaults favour reach over safety. Treat external chat the way you treat inbound email: decide who may reach your staff, log first contact, and keep remote access tools to the one your help desk actually uses.

Our safeguarding and hardening work includes reviewing Teams external access, Quick Assist and remote tool policy, and security operations watches for the chat-to-remote-session pattern described here. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: Arctic Wolf Labs, The Hacker News, Help Net Security, Dark Reading, Sophos, BleepingComputer, Microsoft Learn: Set-CsTenantFederationConfiguration, Microsoft Learn: Quick Assist.