Hackers Bury Inboxes in Spam Then Show Up on Microsoft Teams Posing as IT Support
Help Net Security, Tuesday, October 27th, 2026
Arctic Wolf documented over 400 incidents where attackers flooded inboxes with spam, then posed as IT help desk staff on Microsoft Teams.
Arctic Wolf researchers documented more than 400 incidents abusing Microsoft Teams external chat, which is on by default, in a technique tied to Black Basta, Cactus, 3AM and Chaos.
Attackers flood a victim's inbox with spam, then message them on Teams posing as IT support, often using free onmicrosoft.com tenants or paid domains with convincing display names.
They move to a voice call and persuade the target to install remote access software such as Quick Assist, AnyDesk or ScreenConnect, and malicious code can run within 15 minutes, sometimes leading to data theft and ransomware.
Researchers recommend limiting external Teams chat to partner domains and restricting remote access tools.