Vulnerabilities
Hackers Flood Inboxes With Spam, Then Pose as IT Support on Microsoft Teams
Attackers are flooding employees' inboxes with spam and then contacting them on Microsoft Teams posing as IT help desk staff, offering to fix the very problem they created. Arctic Wolf documented more than 400 incidents involving abuse of the Teams external chat feature, Help Net Security reports.
Threat actors are combining email spam floods with fake IT support messages on Microsoft Teams to trick employees, according to reporting by Help Net Security on findings from security company Arctic Wolf.
Arctic Wolf documented more than 400 incidents in which attackers abused the external chat feature in Microsoft Teams. The pattern is consistent: first, a target's inbox is buried under hundreds of newsletter and subscription confirmation emails. Then, often within minutes, the victim receives a message on Teams from someone posing as an internal IT help desk, offering to resolve the very spam problem the attackers created.
The approach turns a nuisance into a pretext. An employee suddenly facing a flooded inbox may be relieved to see an offer of help and therefore less likely to question whether the "support staff" reaching out are legitimate. Because the contact arrives through Teams' external chat rather than email, it may also sidestep some of the scrutiny typically applied to suspicious messages.
The technique is a form of social engineering that exploits trust in internal IT teams and the familiarity of workplace collaboration tools. According to Arctic Wolf's findings as reported by Help Net Security, the method is being used at scale rather than in isolated attempts, with hundreds of documented cases in which the Teams external chat feature played a role.
Details in this report come from Help Net Security.
Source: Help Net Security
