Back to threat alerts

Weaponisation of Microsoft Teams for IT Support Vishing & Ransomware Deployment

As secure email gateways (SEGs) and automated identity filters have increased in sophistication, advanced threat actors have adapted by migrating initial access operations directly into cloud-native Software-as-a-Service (SaaS) collaboration environments. Microsoft Teams has emerged as a primary target for social engineering, voice phishing (vishing), and administrative helpdesk impersonation campaigns.

Threat alert
August 6, 2026

These campaigns do not rely on zero-day technical exploits for initial access; instead, they abuse native platform configurations to establish direct communication channels with enterprise users. By pairing Teams-based vishing with psychological pressure tactics, threat actors bypass multi-factor authentication (MFA) and trick users into granting interactive remote system access. Once initial access is established via legitimate remote management software, adversaries execute rapid lateral movement and exfiltration pipelines, frequently culminating in total network encryption via double-extortion ransomware strains.

Threat Actor Profiles & Campaign Telemetry

The abuse of Microsoft Teams for helpdesk impersonation spans multiple financially motivated threat clusters and state-sponsored cyber espionage operations.
‍

STAC4749 and Chaos Ransomware Deployment

Tracked extensively between February and June 2026, STAC4749 represents a highly organised, financially motivated threat group that utilises Microsoft Teams vishing as its primary vector for initial access. Statistically, the group has targeted critical infrastructure sectors including services (20%), manufacturing (17%), energy (12%), construction and engineering (12%), and legal entities specialising in intellectual property law. STAC4749 operators register custom IT-themed infrastructure under top-level domains (TLDs) such as .top and establish rogue Microsoft 365 tenants containing plausible administrative employee aliases. The group's operational speed is notable: in multiple documented intrusion cases, the elapsed time from the initial two-minute Teams vishing call to enterprise-wide data exfiltration and Chaos ransomware deployment was less than two hours.

Storm-1811 and GOLD REBELLION (Black Basta)

First documented by security researchers in mid-2024, Storm-1811 is a high-volume cybercrime operation affiliated with the deployment of Black Basta ransomware. Storm-1811 pioneered the combination of automated email spam bombing and real-time tech support vishing. Operators establish rogue Entra ID tenants displaying administrative names such as "Help Desk Support" or "IT Support". Upon gaining remote access to target endpoints via native Windows tools, Storm-1811 operators deploy adversary-in-the-middle (AiTM) kits, SystemBC proxy trojans, Cobalt Strike beacons, and Qakbot malware prior to dropping Black Basta payloads.

STAC5143, STAC5777, and 3AM Ransomware Affiliates

Activity clusters designated as STAC5143 and STAC5777 demonstrate strong operational overlap with legacy Conti groups and FIN7 intrusion sets. These threat actors combine automated email flooding with external Teams video and voice calls. Once an interactive screen-sharing session is established, operators deploy custom Java Archive loaders, Python-based backdoors, and virtual machine (VM) instances designed to execute underneath host-based Endpoint Detection and Response (EDR) sensors. These intrusions frequently hand off access to 3AM ransomware operators, an extortion group closely linked to BlackSuit and Royal ransomware infrastructure.
‍

Advanced Persistent Threat (APT) Operations: UNC6692 and Cloaked Ursa

SaaS collaboration abuse is not limited to ransomware syndicates. Advanced persistent threat actors, including UNC6692 and Cloaked Ursa (APT29), systematically utilise Teams phishing:

  • UNC6692 conducts multi-stage intrusions by initiating inbox-flooding campaigns followed by Teams messages containing links to cloud-hosted landing pages disguised as mandatory "Microsoft Spam Filter Updates".
  • Cloaked Ursa leverages compromised legitimate partner tenants to issue Teams messages containing links to credential-harvesting portals that replicate Microsoft corporate sign-in flows to steal active authentication tokens.
End-to-End Attack Chain
  1. Reconnaissance and Rogue Infrastructure Staging: Adversaries perform open-source intelligence (OSINT) and dark web profiling to harvest active corporate email addresses and job titles. Concurrently, threat actors acquire external TLDs crafted to mimic corporate update portals or security vendors, register new Microsoft 365 tenants associated with these domains, and populate user profiles with deceptive administrative aliases.
  2. Teams Vishing Initiation: The threat actor initiates contact via Microsoft Teams, leveraging cross-tenant federation. An external voice call or high-priority chat prompt is initiated, with the actor identifying themselves as a technician from the internal helpdesk or an outsourced IT Managed Service Provider (MSP).
  3. Interactive Remote Access Hijacking: Once verbal rapport and trust are established, the adversary instructs the victim to launch a remote assistance utility. Threat actors frequently rely on native Windows utilities such as Microsoft Quick Assist or deploy cloud-managed Remote Monitoring and Management (RMM) software. The caller provides a numeric connection code; upon input by the victim, the adversary requests full interactive system control.
  4. Credential Harvesting and MFA Bypass: With interactive control over the victim's desktop, the threat actor navigates the active browser session to an adversary-controlled landing page. Attackers instruct the victim to re-authenticate or approve a push notification prompt under the pretext of validating system credentials. The AiTM proxy intercepts the plaintext credentials, captures the resulting session cookie, and bypasses MFA entirely, providing persistent cloud identity access.
  5. Post-Exploitation Staging and Modular Malware Delivery: Operating via the active Quick Assist session or secondary command shells, the attacker opens PowerShell or Command Prompt instances to stage local persistence. Adversaries execute scripts and obfuscated commands to retrieve first-stage payloads from file-hosting infrastructure.
    • STAC4749 Operators deploy modular loaders into user-writable directories. These loaders conduct host profiling, verify product-specific sandbox markers, and establish command-and-control (C2) channels using gRPC over port 443 across hardcoded IP clusters. The loader drops a PyArmour-obfuscated PyInstaller backdoor. Upon execution, this backdoor dynamically contacts public GitHub repositories to retrieve AES decryption keys and Initialisation Vectors (IVs) to unlock secondary execution modules capable of running arbitrary shell commands.
  6. Defence Evasion, Persistence, and Lateral Traversal: To maintain operational access outside the active Teams session, adversaries establish redundant lateral pathways:
    • Service Configuration Modification: Operators execute commands via msconfig or standard Windows Service Control (sc.exe) to force the activation of Remote Desktop Protocol (RDP) across host endpoints.
    • Reverse SOCKS Tunnelling: Attackers deploy lightweight tunnelling binaries to construct reverse SOCKS proxy connections to remote infrastructure.
    • Custom C2 Implants with Certificate Pinning: Operators execute Golang-based C2 binaries utilising explicit command-line flags. These implants embed custom Certificate Authority (CA) certificates. The implant will only connect if the upstream C2 server presents a matching CA issuer, neutralising dynamic C2 sandbox inspection and network middlebox interception.
  7. Data Exfiltration: Before deploying destructive encryption payloads, adversaries conduct rapid internal discovery to map domain controllers, file shares, and backup infrastructure. Using legitimate command-line synchronisation tools such as Rclone, operators establish automated outbound transfers to public cloud storage infrastructure.
  8. High-Velocity Ransomware Detonation: With exfiltration completed and persistence established across domain controllers, adversaries execute final-stage ransomware payloads via automated batch scripts, PsExec, or Group Policy Objects (GPOs). In STAC4749 intrusions, Chaos ransomware executables are distributed across all mapped network endpoints simultaneously. Files are encrypted, extensions are modified, and ransom notes titled readme.chaos.txt are generated.
Technical Mechanics of Warning Banner Evasion

By default, Microsoft Teams enables open cross-tenant federation. This setting permits any user registered in any Microsoft 365 tenant worldwide to search for internal corporate users using their email address and initiate direct messaging or voice calls. Furthermore, default settings often permit communication with unmanaged personal Microsoft accounts, allowing threat actors to operate completely outside enterprise tenant controls.
‍

Microsoft Teams incorporates built-in security features designed to alert users when interacting with external contacts, including external tags, "First Contact" Accept/Block screens, and high-confidence phishing notifications. Adversaries employ specific methods to bypass or neutralise these visual safeguards:

  • Direct Voice Call Overrides (Vishing): When an external adversary sends a text message, Teams displays a safety banner requiring the user to explicitly accept or block the request. However, if the adversary initiates a direct voice or video call from an external meeting instance, Teams displays a standard incoming call ring pop-up. If the victim answers, the interactive session opens directly, bypassing the text-based external warning banner. Once answered, subsequent text-based chat within that call context is permitted without displaying the security prompt.
  • Unicode Space Character Padding: Threat actors inject extended sequences of non-breaking space characters into their display names. In the standard Teams graphical interface, this excessive padding pushes the trailing (External) visual tag off the visible boundary of the desktop client window, causing the user to see only the spoofed administrative name.
  • API Manipulation for Group Chat Approval Bypass: Standard one-on-one external chat invitations prompt an approval flow. Attackers bypass this by using client interception proxy tools to alter the underlying API request. By initiating a group chat creation request and appending the target victim's UPN twice within the recipient list array, the API treats the session as an active group collaboration, dropping the initial approval prompt on the recipient's endpoint.
  • HTTP POST Payload Modification and CSS Injection: In web-client environments, advanced adversaries intercept out-of-band POST requests when transmitting chat messages. By injecting custom inline HTML/CSS styling into the content body parameter, adversaries can render absolute white block overlays directly on top of the DOM elements that display the (External) warning tag, effectively cloaking their external status. Furthermore, attackers modify payload parameters within raw HTTP requests to display legitimate Microsoft Word or PDF icons for attached files while routing the actual click-through link to malicious payload infrastructure.

Mitigations & Defensive Recommendations
Microsoft Teams Tenant Hardening & Federation Control
  • Disable Access from Unmanaged Accounts: Navigate to Microsoft Teams Admin Center > Users > External access. Toggle off "People in my organisation can communicate with unmanaged Teams accounts". This blocks personal Microsoft accounts from initiating chats or calls with enterprise staff.
  • Transition Open Federation to Explicit Allow-Lists: Under External access, change the domain control model from open federation to "Allow only specific external domains". Populate the domain list strictly with verified business partner and vendor domains.
Identity and Access Management Hardening
  • Phishing-Resistant MFA Deployment: Transition high-value accounts from legacy push notifications to FIDO2 hardware tokens or Certificate-Based Authentication (CBA) to neutralise AiTM proxies.
  • Conditional Access Policies: Implement strict device-bound Conditional Access policies requiring access to corporate applications to originate exclusively from compliant, Hybrid Entra ID-joined endpoints.
Endpoint and Remote Tool Governance
  • Centralise Approved RMM Tools: Maintain a strict list of enterprise-approved remote support applications. Block unapproved cloud RMM tools at the perimeter web proxy and endpoint EDR layers.
  • Harden Windows Remote Management and RDP: Disable RDP across workstations via Group Policy, restricting RDP access strictly to monitored administrative jump servers. Enforce network-level authentication (NLA) and restrict WinRM ports (5985/5986).
Defender Integration & Active Graph API Threat Eradication
  • Enable Safe Links and ZAP: Ensure Microsoft Defender for Office 365 Plan 2 is configured with Safe Links enabled for Microsoft Teams conversations to inspect links at time-of-click. Verify that Zero-Hour Auto Purge (ZAP) is active to retroactively quarantine weaponised chat messages post-delivery.
  • Automated External Chat Purging via Graph API: If a malicious external user initiates a phishing thread, tenant administrators can forcefully purge the chat thread from the internal victim's view using the Graph API endpoint RemoveAllAccessForUser.

‍