Arctic Wolf says attackers flood inboxes, then pose as IT support in external chats to persuade staff to grant remote access, followed in some cases by malware or ransomware.
Arctic Wolf Labs says attackers repeatedly used Microsoft Teams chats to impersonate IT support and persuade employees to grant remote access to their computers. Its findings span hundreds of investigated cases and were published by The Hacker News on October 26.
Teams allows conversations with people outside an organisation when external access is enabled. The attacks target organisations using that feature. Arctic Wolf describes the technique as social engineering—manipulating people into taking an action—rather than exploiting a software vulnerability.
In many cases Arctic Wolf examined, attackers first flooded an employee’s inbox with hundreds of newsletter or subscription confirmations. A Teams message offering IT help followed soon afterwards. The sequence was intended to create urgency and make the offer seem useful.
The attackers used newly created or acquired Microsoft 365 tenants—separate organisational accounts—to establish their Teams identities. Display names such as “IT Support (Internal)” sought to make those outside accounts look like trusted colleagues. Some attackers also added the target company’s name or domain to their display names.
Teams warns users about external accounts. Arctic Wolf says attackers used IT-themed display names to make those accounts seem trustworthy despite the warnings.
Voice phishing, in which attackers deceive people through spoken conversations, also helped persuade employees to allow remote control through legitimate support tools. Arctic Wolf says attackers then used that access to inspect systems, install malware and move to other computers. Some cases progressed to sensitive-data theft and ransomware deployment.
The W27 keeps the Galaxy Z Fold 8 Ultra’s core hardware, with dark-red or dark-blue finishes, golden accents and 16GB of working memory in both storage versions.
2 min
Arctic Wolf found *.onmicrosoft[.]com addresses in roughly 30–40% of the investigated cases. Microsoft automatically creates this permanent fallback domain when a Microsoft 365 tenant is set up. Attackers chose help-desk or support-themed tenant names to make their accounts appear credible.
The company also identified a recent shift towards paid domains. For fake identities using paid domains identified over the preceding few months, it gave the following breakdown:
| Domain ending | Reported share |
|---|---|
| .top | Approximately 50% |
| .com | Around 40% |
| Multi-level endings, such as .com.pl, .com.vn and .com.br | Just over 5% |
Arctic Wolf says attackers generally avoid putting malware download links directly into Teams messages, where link scanning could detect them. Instead, attackers often navigate to the download sites themselves after gaining remote access.
For organisations allowing external Teams chats, Arctic Wolf says monitoring activity on devices and user accounts is therefore essential alongside scanning messages: the attack can move from a support conversation to actions carried out directly on an employee’s computer.
The satellite operator expects access to more than twice OneWeb’s current bandwidth in return for spending in 2027–2034, with initial IRIS² services expected from 2030.
3 min
The black, gold and green edition follows September’s sold-out preorders. Nintendo’s replenished launch-day stock also quickly sold out.
1 min
