Scammers flood inboxes with spam, then pose as IT support on Microsoft Teams

Arctic Wolf documented over 400 incidents where attackers abused Teams external chat to impersonate IT support. Victims' inboxes are first flooded with hundreds of spam emails, then the fake help desk offers to fix it and asks them to install Quick Assist — malicious code runs in under 15 minutes.

• Over 400 incidents abusing Teams external chat; 30–40% used free onmicrosoft.com tenants
• Display names like "IT Service Desk (Matthew)" and "(Internal)" mimic coworkers
• About 50% of paid scam domains used .top, roughly 40% used .com
• After Quick Assist is installed, code runs in under 15 minutes