Threat feed

Teams external-chat IT scam

Teams IT-support impersonation via external chat: 400+ incidents of mail-bomb, ChatCreated first contact and Quick Assist/RMM access; one observed chain runs a PowerShell/MSI loader deploying a Python implant for AD discovery

Posted · Updated · Spectrum Delta Research Team

Summary

Arctic Wolf Labs (Shubham Dubey, Oct 26, A/2) analyzes more than 400 incidents (no full date range stated) in which threat actors abused Microsoft Teams' default-on external access (federation) for initial access: throwaway or acquired M365 tenants — 30-40% still on default *.onmicrosoft[.]com domains, increasingly IT-themed .top/.com paid domains — create one-to-one external chats using 'IT Support (Internal)', emoji-marked and organization-named display names, often minutes after mail-bombing the victim's inbox to manufacture urgency. A voice call from within Teams then walks the victim into launching Quick Assist (quickassist.exe, the most frequent; the report also lists msra.exe, the separate legacy Windows Remote Assistance binary) or a commercial RMM (AnyDesk, ScreenConnect, Atera, Zoho Assist, NetSupport, LogMeIn; Level installed via msiexec); multiple users are targeted within ~5-minute windows (assessed automation) and customer-reported chains reach payload execution in under 15 minutes. The concrete observed example: victim-run PowerShell (explorer.exe parent) downloads an MSI from Azure Blob Storage bundling cleaner.ps1 (hex-array IEX loader that decrypts an AES-encrypted payload with a hard-coded key/IV, hash-checked, executed via ScriptBlock) dropped to AppData\Local\PowershellCleaner\scripts, which extracts pythonw.exe and an ss.py implant from archive6.zip; the implant issues LDAP queries for all AD computer and user objects via adsisearcher and transmits the results to C2 endpoints picked from a domain/URI list. Attackers avoid pasting URLs into Teams (which would trigger Safe Links/ZAP scanning) and instead navigate to payloads during the remote session — shifting the detection burden to endpoint and identity telemetry. Arctic Wolf assesses the chain aligns with vendor-documented campaigns (Microsoft's Black Basta/Storm-1811 2024 origin; Sophos's STAC4749/Chaos .top-domain pivot; Zscaler's GoGRPC) but does not attribute the 400+ incidents to a single actor. (Arctic Wolf Labs, A/2).

Breakdown

Adversary

Unnamed social-engineering clusters

Procedures (4)

  1. External-tenant Teams chat first contact via ChatCreated

    First contact: throwaway external tenant creates one-to-one Teams chat with IT-support impersonation

    Logs

    • M365/Teams audit · ChatCreated; sender UPN, display name, HasForeignTenantUsers, CommunicationType

    Detectors

    • Arctic Wolf detection · ChatCreated-stage first-contact alert on external-tenant patterns
Click to expand remaining (3) procedures

  1. Mail-bomb burst floods inbox before IT-support chat

    Mail-bomb precursor: inbox flooded to manufacture urgency and bury security alerts

    Logs

    • Exchange message trace · Per-recipient inbound volume: hundreds of subscription confirmations in minutes

    Detectors

    No known detector

  2. Quick Assist / RMM tool execution under victim account

    RMM tool execution: victim account launches Quick Assist or installs a commercial RMM under attacker direction

    Logs

    • Windows process execution · quickassist.exe/msra.exe launch; unsanctioned RMM msiexec install

    Detectors

    No known detector

  3. PowerShell hex-array AES loader executes via ScriptBlock

    PowerShell loader execution: hex-array IEX decodes AES-encrypted payload and executes via ScriptBlock

    • T1059.001Command and Scripting Interpreter: PowerShell

    Logs

    • PowerShell script-block logs · IEX hex-array decode; AES-decrypt stub; ScriptBlock execution

    Detectors

    No known detector

Indicators of compromise

Hunt only

Attacker-controlled tenants within Microsoft's legitimate *.onmicrosoft.com namespace (the report's appendix lists 13; the namespace itself is legitimate — the tenant-naming pattern is the hunt key, not the domain): supportedge33/39, helpdeskteam365, itendpoint365, itcoreportal, networkadmin797/916, itadmin922, supportagentonline, threatpro, ithelpplus42, corporateitservicellc, techsupport2337[.]onmicrosoft[.]com. IT/update-themed .top payload-C2 domains: update-software, infoupdate-it, soft-program, getsysmonitor, programupdate-assis, expertassist, sec-check-it, upd-check-soft, assis-programupdate, get-info-check, updsysseq, techrelay, verifsec-update, sys-update-check, get-help, it-assistant, ms-system-check, scan-updseq, it-seccontrol, verifcontrol-update, get-upd-sys, get-sys-info, getsystembridge, data-sys-seq, soft-network[.]top. Helpdesk lookalike .com: helpdesk-support-us-ny, helpdesk-support-office-3/4, helpdesk-support-us3, helpdesk-call, helpdesk-s1x, itdeskassist[.]com. Other payload/credential-phishing domains: kilan[.]com[.]pl, saludcentro[.]gov[.]co, ggc[.]com[.]ph, scapini[.]com[.]br. Assessed 2026-10-27 — throwaway tenants and cheap .top infrastructure rotate; treat as hunt keys for tenant-naming and TLD patterns rather than durable blocks. Neither the onmicrosoft.com namespace nor the .top TLD alone establishes maliciousness — keep all disposable domains hunt-only with pattern-based hunting.

Durable

ChatCreated first-contact event as the primary detection stage; external-tenant naming taxonomy (support/IT/admin/network/helpdesk themes + 365/online/portal/random number); display-name taxonomy ('IT Support (Internal)', friendly first names, region-specific forms like 'Supporte TI', ~100+ emoji markers, target-org domain in display name); ~50% of paid domains on .top, ~40% .com, ~5% multi-level (.com.pl/.com.vn/.com.br); QuickAssist.exe and msra.exe as the most frequent RMM entry; RMM set AnyDesk/ScreenConnect/Atera/Zoho Assist/NetSupport/LogMeIn/Level (msiexec); AppData\Local\PowershellCleaner\scripts\cleaner.ps1 (hex-array IEX + AES hard-coded key/IV + hash check + ScriptBlock execution); archive6.zip bundling pythonw.exe + ss.py implant; adsisearcher LDAP enumeration formatted [sAMAccountName] – [description]; ~5-minute multi-user targeting windows (automation); under 15 minutes from engagement to payload execution; URLs deliberately not pasted into Teams (Safe Links/ZAP avoidance — payloads fetched during the remote session)

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of Teams external-chat IT scam? Bring them to the community.

Discuss in the Tradecraft Slack