Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware

Cybersecurity researchers have identified a recurring social engineering pattern across hundreds of incidents where threat actors exploit Microsoft Teams' external chat creation feature to conduct impersonation scams and deliver malware. Attackers consistently use throwaway tenants to pose as IT support personnel, tricking users into granting access or executing malicious payloads. The campaign has been linked to ransomware deployment as well as general malware distribution. The pattern suggests an organized and scalable attack methodology leveraging legitimate collaboration platform features. Organizations relying on Microsoft Teams for internal communication are particularly at risk if external messaging is not properly restricted.