A consistent and concerning pattern of social engineering attacks is emerging, primarily targeting organizations via **Microsoft Teams**' external chat functionality. **Arctic Wolf Labs** has detailed a recurring modus operandi where attackers utilize throwaway tenants, 'IT Support (Internal)' display names, and remote-access tools to compromise victims.  ### The Anatomy of the Attack These campaigns consistently employ IT-themed or friendly-sounding display names to bypass external user warnings within Teams. The messages originate from newly created or acquired **Microsoft 365** tenants. ### Exploiting *.onmicrosoft[.]com Domains Approximately 30-40% of the cases investigated by **Arctic Wolf Labs** involve the use of `*.onmicrosoft[.]com` domains. These are permanent fallback domains automatically generated by **Microsoft** for new **Microsoft 365** tenants. Attackers craft these domains to appear legitimate, often incorporating help desk or support-themed words, such as: * helpdeskteam365.onmicrosoft[.]com * itendpoint365.onmicrosoft[.]com * itcoreportal.onmicrosoft[.]com * itadmin922.onmicrosoft[.]com * corporateitservicellc.onmicrosoft[.]com ### Pre-Attack Mail Bombing and Urgency Tactics Many of these **Teams** sessions are preceded by mail bombing, where victims' inboxes are inundated with hundreds of newsletter or subscription confirmations. This tactic is designed to create a false sense of urgency, with the **Teams** IT support message arriving shortly after to offer a seemingly timely resolution. ### Evolving Display Names and TLDs Observed display names include generic titles like 'Help Desk' and 'IT Support', as well as more specific ones such as 'IT Service Desk – Liam' or 'Enterprise IT & Security (Internal)'. Recently, attackers have begun to embed the target organization's domain or company name within their display names to enhance credibility.  There's also been a shift towards using paid top-level domains (TLDs) for tenant creation. Approximately 50% of these fake identities now use the `.top` TLD, 40% use standard `.com` domains, and just over 5% utilize multi-level domains like `.com.pl`. ### Connection to **STAC4749** and **Chaos Ransomware** This activity aligns with that of **STAC4749**, a threat group known for creating IT-themed cloud domains under the `.top` TLD and leveraging plausible employee usernames. **Sophos** has linked these attacks to the deployment of **Chaos ransomware**. ### Vishing and Remote Access Tools The attacks specifically target organizations with external access enabled. A crucial element involves vishing, where victims are tricked into granting attackers hands-on-keyboard access through legitimate Remote Monitoring and Management (RMM) tools such as **Quick Assist**, **AnyDesk**, **ScreenConnect (ConnectWise)**, **TeamViewer**, **Atera**, **Zoho Assist**, **NetSupport**, and **LogMeIn**. Once remote access is established, threat actors conduct reconnaissance, deploy additional payloads like the **GoGRPC** backdoor, facilitate lateral movement to domain controllers, and install redundant RMM tools like **Level**. This precedes sensitive data exfiltration and the deployment of ransomware. ### Evasion Techniques and Payload Delivery Attackers often avoid directly pasting URLs into **Teams** chats to bypass **Safe Links** / **ZAP** scanning. Instead, they navigate to the payload themselves during the remote session. This highlights the critical need for robust endpoint and identity telemetry monitoring alongside message scanning. In one instance, the threat actor instructed a user to execute a **PowerShell** command to download and launch an MSI installer from **Microsoft Azure Blob Storage**. This installer then deploys a **Python** implant that performs LDAP queries to **Active Directory** for computer and user objects, transmitting the data to an external server. ### The Power of Exploiting Trust **Arctic Wolf Labs** emphasizes that external **Microsoft Teams** chat has become an effective initial-access vector because it exploits trust rather than a software vulnerability. The combination of email bombing, convincing IT-support impersonation, newly created tenants and domains, and rapid social engineering enables attackers to quickly escalate from a seemingly routine chat to remote access, payload execution, and, in some cases, broader network compromise.