Fake IT Support Chats on Microsoft Teams Lead to Backdoors and Ransomware

Attackers are flooding employee inboxes with junk subscription emails and then contacting victims on Microsoft Teams, posing as internal IT help desk staff from disposable Microsoft 365 tenants. Arctic Wolf Labs has tracked hundreds of such cases, in which the chats led to backdoors, lateral movement to domain controllers, and data theft. Sophos has linked some of these intrusions to Chaos ransomware. No software patch exists because no vulnerability is exploited; defenders are advised to restrict external Teams access, control which remote monitoring tools can run, and monitor endpoint and identity activity. Organizations that allow external access in Teams, especially those accustomed to getting help desk support through chat, face the greatest risk.