Our takeAttackers are using throwaway Microsoft tenants to open external Teams chats that impersonate internal IT and push malware or ransomware. Treat every unsolicited Teams message as suspect; verify out-of-band before clicking anything or calling back.Security Resilience desk
Sources (5)
- hackernews · hackernews
- the420_in · the420_in
- helpnet · helpnet
- hackread · hackread
- hackernews · hackernews
What this means for you — Security leader:Train helpdesk and end users to treat unsolicited external Teams messages as suspect; verify any IT support request out-of-band before clicking links, granting access, or downloading anything.
What this means for you — Lean IT orgs:If you get an unexpected Teams message from someone claiming to be IT support, close it and call your actual provider using a known good number before taking any action.
What this means for you — MSP:Advise all clients to disable external chat creation where feasible and treat every unsolicited Teams IT-support request as malicious until verified out-of-band.
What this means for you — Researcher:Monitor for new throwaway Microsoft 365 tenants used in Teams-based social engineering; the pattern is established across hundreds of incidents.