Microsoft 365 threat report

Threat actors are abusing Microsoft Teams' external chat feature to conduct large-scale social engineering campaigns against organizations. Arctic Wolf documented over 400 incidents where attackers flood employee inboxes with spam, then contact victims posing as IT support using newly created Teams identities, leading to remote access tool installation and code execution in under 15 minutes. The campaign, observed by multiple ransomware groups including Black Basta and Chaos, relies on abuse of default-enabled Teams federation rather than a technical vulnerability.

• Attackers Exploit Teams External Chat to Breach Organizations in(opens in a new tab)
• Hackers bury inboxes in spam then show up on Microsoft Teams pos(opens in a new tab)
• Security News Update: Is Your Enterprise Vulnerable to Recent Ci(opens in a new tab)