Act
active
Attackers Abuse Teams External Chat for IT Support Impersonation and Malware
- Engineer — Plan: Teams’ external-chat feature is being abused at scale; audit your tenant’s external access policy and consider restricting or requiring approval for inbound external chat requests in the Teams admin center.
- SOC/IR — Act: Hundreds of confirmed cases share a pattern of throwaway tenants with IT-themed names initiating chats that precede malware drops; hunt for Teams external-chat sessions from newly created tenants and correlate with unusual child-process creation from Teams.exe since at least early October 2026.
- Leader — Plan: A high-volume campaign is using Teams to impersonate internal IT and deliver ransomware; schedule an employee awareness communication this week and direct the team to review the tenant’s external-communications policy before next quarter.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.