Teams external chat abused to breach orgs in under 15 minutes

Arctic Wolf observed over 400 incidents where attackers abused Microsoft Teams' external chat feature to gain initial access. Posing as IT support, they combine email bombing with social engineering to reach payload execution in under 15 minutes via Quick Assist.

• Over 400 incidents abusing Teams external chat
• 30–40% of cases used unverified onmicrosoft.com tenants
• Payload execution reached in under 15 minutes
• AnyDesk and ScreenConnect used for persistence