Arctic Wolf has observed a tactic where malicious actors first saturate employees' inboxes with spam before engaging them via Microsoft Teams.
These threat actors then approach victims through Teams, impersonating IT support personnel and offering to resolve the issues they themselves generated.
The security firm documented over 400 instances where the external chat capability within Teams was exploited for this purpose.
In numerous documented cases, the fraudulent help desk communication appeared mere minutes after the target's mailbox had been overwhelmed with hundreds of subscription confirmations and newsletters.
The specific report detailing this activity was initially published on Help Net Security, under the title "Microsoft Teams ̷... The post Hackers bury inboxes in spam then show up on Microsoft Teams posing as IT support."
This pattern represents a sophisticated social engineering vector, leveraging platform features to escalate an initial low-level intrusion into a direct support interaction.
The deployment of such multi-stage attacks highlights evolving methods employed by threat actors against enterprise communication platforms.
