Arctic Wolf logged more than 400 incidents in which attackers flooded employee inboxes with newsletter and subscription confirmations, then messaged the same people on Microsoft Teams minutes later posing as IT support. The fake help desk offered to fix the outage the operators had just created. Your firewall never saw the payload. The session ran inside a collaboration channel most cybersecurity programs still treat as a productivity feature.

Subscription Confirms Arrived First, Then the Teams Persona

The flood is the point of the operation, not a side effect. Hundreds of confirmations land in a short window: newsletters, retail lists, webinar signups, password messages the user never requested. The mailbox stops being a work tool. It becomes a siren. People who would ignore a cold ping on Teams will accept a chat from IT when they cannot find payroll or the all-hands note.

Help Net Security’s report on Arctic Wolf’s findings puts the delay in minutes. That timing is operational. Someone already had the address. Someone already knew the tenant accepted external chat. Someone already wrote a script that sounds like your real service desk on a bad morning: we see your mailbox is down, we need you to verify, share your screen, read back the number.

You’re looking at social engineering that manufactures its own ticket. Email phishing still leans on a link or an attachment. This sequence leans on a user who is already drowning and a chat client your organization still exposes to the open internet.

A brute-force spray against the same account would trip lockouts, MFA fatigue alerts, maybe a threat-protection rule on the identity provider. None of that fires when the user is the one sharing the desktop because support asked. The credentials walk out through a channel you blessed.

If you run a SOC, you already know the feeling. The mailbox team is drowning in volume. The identity team is watching failed logons. Nobody owns the 1:1 that just appeared in the client. That gap is the product.

External Chat Turned Help Desk Into an Unauthenticated Channel

Microsoft Teams external access is a business toggle. In a lot of tenants it’s still on because a vendor needed a channel years ago and the exception never expired. Attackers noticed. Arctic Wolf says the external chat feature was the abuse path across these incidents. That setting is yours. That setting is a local configuration choice.

Defense in depth can look complete on the network diagram. Conditional access at the IdP, a hardened remote access stack, a tidy firewall policy. Then a stranger appears in the sidebar with a display name that says Help Desk or Microsoft. Display names are cosmetics. The tenant ID and the verified domain are the identity. If your people cannot distinguish those in a 20-second glance while their inbox is on fire, the control already failed.

I’ve watched telephone help-desk impersonation for a couple of decades. The new part is the cover noise plus the speed. You will not train your way out of a mailbox that just swallowed hundreds of confirms. You can refuse external 1:1 chats for most staff. You can allowlist partner domains. You can make any remaining external contact visually loud in a way nobody misses.

Threat detection for chat still gets leftover budget. Mail gateways get the appliances and the analysts. Teams gets a retention policy. If your SOC cannot list every external 1:1 that touched a privileged user this week, you need a query that returns those chats. You do not have monitoring until that query exists.

This is a bad look for any shop that spent two years locking down email and left federation wide open. The attackers read your architecture better than your exception spreadsheet.

Cut External Access, Then Rebuild Collaboration Cybersecurity

If external chat is not a documented business requirement with named partner domains, turn it off. Do it today. Guest access is a separate decision; treat it with the same suspicion. Then hunt what already happened.

Run this list in order:

• Disable tenant-wide external access; if a partner must remain, allowlist specific domains and block anonymous users.
• Send a same-day banner: IT will not cold-chat you on Teams. Call the published service desk number, even if the chat looks official.
• Review the last 14 days of external 1:1 and meeting chats for executives, admins, finance, and anyone who can approve MFA resets.
• If a user engaged, start incident response as credential theft: revoke sessions and refresh tokens, reset passwords and MFA, inspect inbox rules, app consents, and new device enrollments.

Keep going after the emergency. Treat the collaboration tenant like a jump host during security hardening. Alert on display names that contain Help Desk, IT Support, or Microsoft when the home tenant is foreign. Privileged roles should not accept external 1:1s at all. Put that in policy and in the client experience, not in a wiki nobody reads.

Tabletop the sequence. Inbox unusable, then a Teams persona, then a request for a code or a screen share. Time how long until someone in the SOC hears about it. If the answer is when payroll fails, your cyber security program is still oriented around email and VPN. This campaign will keep landing.

Incident Response After the Victim Already Typed the Code

Once the chat exists, stop arguing about whether it looked real. Assume the operator asked for an MFA prompt, a password-manager fill, Quick Assist, AnyDesk, or a verification number. Screen sharing is remote access. A code read aloud is a session grant. Your job is containment, then scoping.

Pull the Teams audit trail for that user: members added, messages, file drops, meeting joins. Pull identity logs for the same window: new MFA methods, consent grants, mailbox forwarding, a new device that looks like travel. This is one incident with two telemetry planes. If those teams don’t share a ticket, the attacker keeps the mailbox.

A password-change prompt in email leaves the stolen session alive. Revoke refresh tokens, rebuild MFA from a number you called, and watch the account for replay. Call the user on a number you placed. Tell them the Teams persona was hostile. They’ll get follow-up chats. The second one often works better than the first.

Operators who got a live conversation will come back. Keep the account on a watchlist for 72 hours and alert on a second external chat, a new MFA method, or a fresh OAuth consent in that window.

You don’t need a new product category to survive this. You need the same discipline you already claim for VPN and admin workstations, applied to a chat client that can summon a help desk out of thin air.

Sources

• Hackers bury inboxes in spam then show up on Microsoft Teams posing as IT support