INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Teams External Chat Exploited to Breach Organizations in Under 15 Minutes

| 2026-10-27 12:30 HIGH HIGH DATA BREACH
JSON
Executive Summary
AI-generated
Threat actors have been abusing Microsoft Teams' external chat creation feature to target employees for initial access into organizations, with over 400 incidents observed. The attackers combined email bombing, IT-support impersonation, and rapid social engineering tactics to breach organizations in under 15 minutes. They often targeted multiple victims within short windows of time, suggesting the use of automation. In these attacks, threat actors established legitimate-looking Teams identities through newly created or acquired Microsoft 365 tenants, with between 30-40% involving default onmicrosoft[.]com tenant domains that can be provisioned in minutes. The attackers then used fake messages to offer support and resolve issues, before attempting to obtain hands-on-keyboard access using commercial RMM tools like Quick Assist.
Technical Mitigations AI-generated
• Account Use Policies (ATT&CK mitigation for Social Engineering): Adds verification for helpdesk resets, approvals, and app consents commonly targeted by impersonation. • Audit (ATT&CK mitigation for Social Engineering): Enables correlation of email/identity/SaaS/endpoint activity that appears legitimate. • User Training (ATT&CK mitigation for Impersonation): Train users to be aware of impersonation tricks and how to counter them, for example confirming incoming requests through an independent platform like a phone call or in- • Threat Intelligence Program (ATT&CK mitigation for Impersonation): Threat intelligence helps defenders and users be aware of and defend against common lures and active campaigns that have been used for impersonation. • Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Black BastaBlack Basta
Target & Sectors
Global Scope
Incident Timeline
‎October 26, 2026
Threat actors exploited Microsoft Teams' external chat feature to establish legitimate-looking identities and gain unauthorized access to organizations in under 15 minutes.
tactic Impersonation
“Across the activity examined, attackers combined email bombing, convincing IT-support impersonation, newly created tenants and domains, and rapid social engineering to move victims from a seemingly routine chat to remote access, payload execution, and, in some cases, broader compromise,” the Arctic Wolf researchers wrote in the report published on October 26, 2026.
tactic Social Engineering
“Across the activity examined, attackers combined email bombing, convincing IT-support impersonation, newly created tenants and domains, and rapid social engineering to move victims from a seemingly routine chat to remote access, payload execution, and, in some cases, broader compromise,” the Arctic Wolf researchers wrote in the report published on October 26, 2026.
organisation Teams
However, it noted that the use of the external Teams chat as an initial access vector has been a tactic deployed by ransomware groups including Black Basta .
infrastructure Windows
Following the initial contact, the attackers’ next aim in most cases was to obtain hands-on-keyboard access through legitimate remote monitoring and management (RMM) tools, most frequently Quick Assist, which is built into Windows and therefore requires no installation.
organisation RMM
Following the initial contact, the attackers’ next aim in most cases was to obtain hands-on-keyboard access through legitimate remote monitoring and management (RMM) tools, most frequently Quick Assist, which is built into Windows and therefore requires no installation.
infrastructure Microsoft 365
Teams’ external access is turned on by default, meaning any Teams user in another Microsoft 365 tenant can find, chat with, and call an organization’s employees, provided both tenants allow external access.
In the observed incidents, the threat actors established external Teams identities through newly created or acquired Microsoft 365 tenants.
organisation Microsoft
Teams’ external access is turned on by default, meaning any Teams user in another Microsoft 365 tenant can find, chat with, and call an organization’s employees, provided both tenants allow external access.
organisation AnyDesk
When attackers seek persistence beyond the initial call, they pivot to a commercial RMM tool, such as AnyDesk and ScreenConnect.
organisation ScreenConnect
When attackers seek persistence beyond the initial call, they pivot to a commercial RMM tool, such as AnyDesk and ScreenConnect.
data_breach 365 number
The attackers typically selected a support-, IT-, admin-, network-, or helpdesk-themed word as the tenant name, optionally suffixed with the number 365, to appear as an IT-support worker.
‎2026/10/27
Threat actors are abusing Microsoft Teams' external chat creation feature to target employees for initial access into organizations.
infrastructure Windows
The attackers often target multiple victims within short windows of time, which suggests the use of automation.
organisation Microsoft Teams
Threat actors are abusing Microsoft Teams’ external chat creation feature to target employees for initial access into organizations, new research by Arctic Wolf has found.
organisation Users → External
In Teams admin center → Users → External access, select ‘Allow only specific external domains’ and add only the partner domains the organization actively collaborates with Block chat with unmanaged / Teams-consumer accounts, and disable the option that lets unmanaged users start conversations with your users Block federation with trial-only tenants, as attackers commonly prefer free or…
organisation Educate
In Teams admin center → Users → External access, select ‘Allow only specific external domains’ and add only the partner domains the organization actively collaborates with Block chat with unmanaged / Teams-consumer accounts, and disable the option that lets unmanaged users start conversations with your users Block federation with trial-only tenants, as attackers commonly prefer free or…
organisation External
In Teams admin center → Users → External access, select ‘Allow only specific external domains’ and add only the partner domains the organization actively collaborates with Block chat with unmanaged / Teams-consumer accounts, and disable the option that lets unmanaged users start conversations with your users Block federation with trial-only tenants, as attackers commonly prefer free or…
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
The attackers often target multiple victims within short windows of time, which suggests the use of automation.
Following the initial contact, the attackers’ next aim in most cases was to obtain hands-on-keyboard access through legitimate remote monitoring and management (RMM) tools, most frequently Quick Assist, which is built into Windows and therefore requires no installation.
Metrics
infrastructure
‎Microsoft 365
Affected Product
Teams’ external access is turned on by default, meaning any Teams user in another Microsoft 365 tenant can find, chat with, and call an organization’s employees, provided both tenants allow external access.
In the observed incidents, the threat actors established external Teams identities through newly created or acquired Microsoft 365 tenants.
Metrics
data_breach
365
Number
The attackers typically selected a support-, IT-, admin-, network-, or helpdesk-themed word as the tenant name, optionally suffixed with the number 365, to appear as an IT-support worker.
Intelligence Sources
Infosecurity-Magazine 2026-10-27