This threat involves phishing attacks conducted through Microsoft Teams, where attackers impersonate IT department personnel to deceive employees into approving MFA prompts or entering credentials. The attacks leverage external chat capabilities and federation features in Teams, often exploiting compromised or lookalike Microsoft 365 tenants to appear legitimate. The attackers rely on user trust in collaboration tools and permissive external communication settings to initiate chats that bypass traditional email phishing defenses. Notable threat actors such as Cloaked Ursa (APT29) and UNC6692 have operationalized this technique. Defenses focus on restricting external chat initiation, user awareness training tailored to Teams, and enforcing identity protection policies. Microsoft Teams includes impersonation warnings, but user vigilance remains critical. Organizations should configure Teams to limit external communications and monitor for suspicious activity to reduce exposure.

Successful phishing attacks via Microsoft Teams can lead to credential compromise and unauthorized access to organizational resources. The attacks exploit trusted communication channels, increasing the likelihood of user interaction and subsequent account compromise. This can result in identity theft, lateral movement within networks, and potential data breaches. The threat actors have demonstrated the ability to bypass traditional email phishing defenses by shifting to collaboration platforms. The impact is medium severity given the reliance on social engineering and the potential for significant access if successful.

A fix for this threat involves configuration changes and user training rather than software patching. Organizations should review and tighten Microsoft Teams external communication settings by disabling or restricting chats from unmanaged or personal accounts and limiting federation to specific trusted domains. User awareness training must explicitly cover phishing risks in collaboration tools, including recognizing external indicators and verifying unexpected IT support requests through separate channels. Identity protections such as Conditional Access policies and just-in-time privileged access management should be enforced to reduce risk from compromised accounts. Monitoring external chat initiation and enabling user reporting of suspicious messages can help detect and respond to attacks. These mitigations align with Microsoft’s best practices and Unit 42 recommendations.