Adversaries are exploiting Microsoft Teams' default external chat functionality to conduct social engineering attacks and deliver malicious payloads. Analysis of over 400 incidents reveals threat actors consistently impersonate IT support personnel using throwaway Microsoft 365 tenants with IT-themed display names marked as "(Internal)" to bypass external-user warnings. Attacks frequently begin with email bombing followed by Teams contact offering assistance. Adversaries leverage legitimate remote monitoring tools like Quick Assist, AnyDesk, and ScreenConnect to gain hands-on-keyboard access, progressing from initial contact to payload execution in under 15 minutes. Infrastructure patterns show a shift from default onmicrosoft domains toward paid top-level domains, particularly .top domains comprising 50 percent of observed cases. The technique exploits legitimate collaboration features rather than software vulnerabilities, requiring organizations to implement allow-list policies and user training to disru...
Since January 2026, a threat actor likely functioning as an initial access broker for ransomware operations has been targeting organizations through Microsoft Teams vishing attacks. Attackers impersonate IT helpdesk staff to convince victims to initiate Quick Assist remote sessions. Following initial compromise, PowerShell scripts deploy a Go-based backdoor called GoGRPC, which exists in four distinct variants: Lep, Giver, Pet, and Kind. These variants communicate with command-and-control infrastructure using gRPC over HTTP/2, an uncommon approach that helps blend malicious traffic with legitimate communications. Additional tools observed include BlindDoor backdoor, RevSocket and PyGRPC SOCKS proxies, S3Siphon data exfiltration utility, and RSOX Rust-based proxy relay. Recent campaigns show increased sophistication and selectivity, with heightened focus on corporate environments through enhanced PowerShell scripts capable of antivirus detection, domain controller fingerprinting, and system reconnaissance b...