Arctic Wolf has documented a repeatable intrusion template built on Microsoft Teams rather than on a software flaw. Across more than 400 cases, researchers saw the same throwaway Microsoft 365 tenants, the same IT Support (Internal) display names, the same remote-access tools and, increasingly, the same payload servers.
The pattern starts before Teams. A victim’s inbox is flooded with hundreds of newsletter sign-ups, enough to look broken, and then a chat request arrives from someone offering to fix it. Recently created tenants supply the personas, and roughly 30-40 percent of the cases used the automatic .onmicrosoft.com fallback domain, named with help-desk words such as itendpoint365 or corporateitservicellc to read as internal infrastructure.
Where the conversation leads
Once a target accepts, the fake technician talks them into an interactive session over Quick Assist, AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport or LogMeIn. Reconnaissance, lateral movement toward domain controllers, additional backdoors and data theft follow from that foothold.
Persistence in the observed set included a GoGRPC backdoor and a second remote management agent kept for redundancy. In one case the operator simply asked the user to run a PowerShell line that fetched an installer from Azure Blob Storage, which then unpacked a Python implant that queried Active Directory.
Arctic Wolf notes the attacker typically avoids pasting links into the chat, and browses to the payload only during the remote session, so Safe Links scanning never sees the URL. The activity overlaps with STAC4749, a cluster previously tied to Chaos ransomware deployments.
Defensive gaps worth closing
Restricting Teams federation to known partner domains remains the most direct control, since every case depended on external chat being open. Reviewing newly registered tenants, alerting on .onmicrosoft.com senders and monitoring remote-support tooling on endpoints close the next layers.
