Threat watch / Campaign
Fake IT support on Teams: email bombing, then a chat, then remote access in under 15 minutes
Arctic Wolf Labs reports more than 400 incidents at its customers where attackers first flooded a user's mailbox with newsletter sign-ups, then contacted them through Microsoft Teams external chat from a throwaway tenant, posing as "IT Support (Internal)". The user is talked into opening a remote access tool such as Quick Assist, AnyDesk or ScreenConnect, and a payload can follow in under 15 minutes. Arctic Wolf says no Teams vulnerability is used: the attackers rely on external access, which is on by default.
- Sector
- Many sectors
- Way in
- Phishing, social engineering
- Product or vendor
- Microsoft Teams, Quick Assist, AnyDesk, ScreenConnect, TeamViewer
- How it happened
- Social engineering, not a flaw: a mail bomb of newsletter sign-ups, then an external Teams chat from a throwaway tenant (often an onmicrosoft.com domain) with a display name such as "IT Support (Internal)", then a voice call that talks the user into starting a remote access tool. Arctic Wolf says the activity "does not exploit any known Teams vulnerability" and abuses external access, which is on by default.[1][2] Checked 11 Nov 2026
- What was stolen
- Not public yet Checked 11 Nov 2026
- Who was impacted
- Employees of organizations that leave Teams external access open; Arctic Wolf counts more than 400 incidents among its own customers. It has not named the victims or said how many led to a full compromise.[1][2] Checked 11 Nov 2026
- Threat actor
- Not attributed
Timeline
- Arctic Wolf Labs publishes its research: more than 400 incidents where Teams external chat was used for initial access after a mail bomb, with remote access tools such as Quick Assist, AnyDesk, ScreenConnect or TeamViewer, and a payload in under 15 minutes. It advises limiting external access to an allow-list of trusted domains and blocking chats from trial tenants. [1]
- IT-Connect covers the campaign in French and relays Arctic Wolf's advice to restrict Teams external access to an allow-list. [2]