Attackers posing as IT support in Microsoft Teams are turning ordinary-looking chats into a route to ransomware, according to research from Arctic Wolf Labs and Sophos. Arctic Wolf says it analysed more than 400 incidents involving abuse of Teams external chat, in which attackers used throwaway Microsoft 365 tenants and IT-themed display names such as 'Help Desk' and 'Enterprise IT and Security (Internal)'. Sophos tracked the related cluster, STAC4749, across dozens of North American organisations between February and June 2026.

From remote help to ransomware

The deception does not rely on a Teams software flaw. Teams external access is on by default in many setups, so a user in another tenant can contact staff if both sides allow it. Attackers exploit that trust, sometimes after flooding the victim's inbox with subscription emails, so a helpful Teams message arrives just as the victim seeks a fix. Once contact is made, the attacker talks the victim into a remote-access session, most often through Quick Assist, and then through tools such as AnyDesk, TeamViewer or ScreenConnect. From there, attackers can move across the network and, in some cases, deploy Chaos ransomware. Sophos reported at least three STAC4749 compromises ending in Chaos ransomware, with encryption beginning in under 17 hours in one case.

Why message scanning alone misses it

Arctic Wolf notes a shift away from free .onmicrosoft.com tenants towards paid domains, with .top accounting for about half of the paid-domain cases observed. Attackers have also begun adding the target organisation's own name or domain to their display name. The researchers stress that attackers generally avoid pasting a malicious link directly into Teams, because that would trigger link scanning, and instead browse to the payload themselves during the remote session. Organisations should therefore restrict which external domains can contact staff and verify unexpected support requests through a known internal channel before granting remote access.

Sources: Arctic Wolf; The Hacker News.