Threat actors are exploiting Microsoft Teams’ external chat feature to pose as IT support staff, tricking users into granting remote access that enables ransomware deployment. According to cybersecurity researchers, the attack relies on a recurring social engineering pattern involving throwaway tenants and friendly display names to bypass security warnings.
The Anatomy of a Fake IT Support Channel
The attack begins when a threat actor creates a new Microsoft 365 tenant, often using a throwaway domain. Nearly 30 to 40 percent of investigated cases involve the use of .onmicrosoft.com domains, which are automatically generated by Microsoft when a new tenant is set up. These domains are chosen because they appear to belong to the Microsoft ecosystem, lowering the guard of the recipient.
Once the tenant is established, the attacker assigns a display name designed to look legitimate. Common examples include “IT Service Desk – Liam” or “IT Service Desk – Matt.” These names mimic the language of a help desk, which helps the message evade external-user warnings built into Teams. In recent iterations, attackers have gone a step further, appending the target organization’s actual domain or company name to the display name. This small addition is intended to make the message feel expected and credible to the victim.
Domains and Identities Used to Lure Victims
To complete the illusion, the attackers rely on specific top-level domains. Of the paid domains identified in these scams over recent months, approximately 50 percent used the .top TLD, around 40 percent used a standard .com domain, and just over five percent used multi-level domains such as .com.pl, .com.vn, and .com.br. This distribution suggests a deliberate effort to mix domain types to avoid easy block lists.
The activity has been linked to a threat group tracked as STAC4749. Researchers note that this group has a history of creating IT-themed cloud domains under the .top TLD and using plausible employee usernames to make the accounts appear authentic. The use of these domains helps the fake IT support identities pass initial credibility checks.
From Chat to Remote Access and Ransomware
The ultimate goal of the impersonation is not just a conversation, but hands-on-keyboard access. The attacks specifically target organizations where external access is enabled in Teams. After establishing contact, the perpetrators employ a technique known as vishing, or voice phishing, to convince the victim to grant remote access via a legitimate remote monitoring and management (RMM) tool. Tools commonly cited in these cases include Quick Assist, AnyDesk, TeamViewer, and ScreenConnect.
Once remote access is granted, the abuse begins. The attacker uses the connection to conduct reconnaissance, deliver additional payloads such as a GoGRPC backdoor, and facilitate lateral movement across the network. In some instances, additional RMM tools like Level are deployed for redundancy. The final objective is the exfiltration of sensitive data and the deployment of ransomware binaries, such as Chaos, to encrypt the victim’s files.
What This Means for Organizations
The practical upshot is that the legitimacy of the sender in Microsoft Teams can be deceptive. Because the attacks leverage throwaway tenants and familiar IT terminology, standard security controls that flag external users may not be sufficient. Organizations are encouraged to verify the source of unexpected IT support messages through a separate channel, such as a known internal phone number or ticketing system, before granting any remote access. Awareness of these recurring patterns—the use of .onmicrosoft.com domains, IT-themed display names, and the .top TLD—is a necessary step in defending against this evolving threat.
Teams Growth and the Expansion of External Access Risks
Microsoft Teams has grown from a workplace chat tool into the central collaboration hub for the Microsoft 365 ecosystem. The platform launched worldwide on March 14, 2017, initially lacking support for external users—a limitation Microsoft later addressed to compete with Slack. Adoption accelerated dramatically during the COVID-19 pandemic; Microsoft reported 44 million daily active users on March 19, 2020, and reached approximately 280 million monthly active users by January 2023. This massive user base, combined with the eventual enablement of external access features, has significantly expanded the attack surface for social engineering campaigns.
The external chat capability exploited in these scams is a direct result of Teams’ evolution toward open collaboration. While the platform originally served only internal communication, Microsoft added external access to accommodate business-to-business workflows and guest access. Researchers note that the current attacks “specifically go after organizations where external access is enabled,” meaning the very feature designed to facilitate legitimate partner communication is being weaponized. Because the feature is often enabled by default or left on for operational flexibility, many organizations may be unaware of their exposure until a fake IT support message arrives.
Mechanics of Fake IT Support Impersonation Tactics
The impersonation strategy relies on a consistent, recurring social engineering pattern. Threat actors establish credibility by creating new Microsoft 365 tenants that masquerade as legitimate IT infrastructure. By selecting tenant names that include help desk or support-themed terminology, such as “corporateitservicellc.onmicrosoft.com,” attackers leverage the .onmicrosoft.com domain—a permanent fallback address automatically generated by Microsoft—in nearly 30 to 40 percent of investigated cases. These identities are further bolstered by the use of plausible employee usernames and IT-themed display names like “Business IT Solutions & Support (Internal).”
To maintain this illusion, attackers utilize a mix of domain types to evade detection. While .onmicrosoft.com addresses are common, recent activity shows a shift toward paid top-level domains. Specifically, approximately 50 percent of identified fake identities used the .top TLD, while 40 percent utilized standard .com domains. A smaller fraction, just over five percent, employed multi-level domains including .com.pl, .com.vn, and .com.br. This distribution, attributed to the threat group STAC4749, is designed to help fake identities pass initial credibility checks when contacting victims.
Sources
- Microsoft Teams
- Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
- mobilezone redefines productivity with Microsoft Copilot Studio agents | Microsoft Customer Stories
Photo: Ed Hardie / Unsplash (Unsplash License)
