What Happened
The Hacker News reports Arctic Wolf Labs found hundreds of cases in which attackers abuse Microsoft Teams external chat. They use IT-themed display names, and some add the target’s company name. About 30 to 40 percent of the cases Arctic Wolf investigated used onmicrosoft.com fallback domains.
The playbook has four steps. Attackers flood the victim’s inbox with subscription confirmations. They send the fake IT message. They phone the victim and talk them into a remote tool such as Quick Assist, AnyDesk, or ScreenConnect. They avoid pasting links in Teams, so message scanning sees nothing. Arctic Wolf ties the activity to the STAC4749 cluster. Sophos links it to Chaos ransomware. Follow-on tools include a GoGRPC backdoor and Level RMM, and Active Directory reconnaissance precedes data theft.
Why This Matters for Canadian Organizations
The report does not mention Canada, but Teams runs across Canadian public sector bodies, hospitals, and mid-sized firms. Many leave external chat open to any tenant. A fake help desk message fits a busy employee who received two hundred spam emails an hour ago.
The attack passes through the human, not a software flaw. Patching does not stop it. A successful intrusion ends in ransomware and stolen data, which triggers PIPEDA breach reporting and, for federally regulated firms, OSFI incident rules.
What to Do
Restrict Teams external access to named partner domains. Block unmanaged remote access tools with application control. Tell staff your real help desk never starts contact through external Teams chat. Alert on mail bombing spikes and new RMM installs, and monitor endpoint and identity telemetry alongside messages. Read more in our Trends archive.
