It starts with an inbox that suddenly stops working. Hundreds of newsletter confirmations, sign-up receipts and subscription notices arrive within minutes, burying everything else. The employee is frustrated and a bit alarmed. Then, as if on cue, a message pops up in Microsoft Teams from someone called "IT Support (Internal)" offering to help.

That helper is the attacker. In new research, Arctic Wolf says it has analyzed more than 400 incidents that follow this script closely. The same throwaway Microsoft 365 tenants turn up again and again, along with the same IT-flavored display names, the same remote access tools and, more and more often, the same payload domains.

The point that matters most for defenders is that nothing here is a software flaw. According to Help Net Security's coverage of the research, the activity does not exploit any known Teams vulnerability. The attackers rely on a feature: Teams external access, also called federation, which lets users chat with people in other organizations and ships turned on by default.

How the con works

Each step of the pattern is ordinary on its own. Put together, they make a convincing story.

Step one is the mail bomb. "Mail bombing" means flooding a mailbox with a huge volume of unwanted email. The Hacker News reports that in these cases the victim's inbox is flooded with hundreds of newsletter or subscription confirmations in a short span of time. The approach is designed to induce a false sense of urgency, with the Teams message from "IT support" arriving soon after to offer a fix. Help Net Security says that in many cases the fake help desk message arrived minutes after the inbox had been filled.

Step two is the Teams contact. The attacker messages the victim from an outside Microsoft 365 tenant. A tenant is an organization's own instance of Microsoft 365. Help Net Security reports that 30 to 40 percent of the cases involved free tenants on Microsoft's default onmicrosoft.com domain, which require no verification and can be set up in minutes, with IT-sounding names such as "helpdeskteam365" and "itcoreportal." The display names are written to look internal, often with "(Internal)" added, even though Teams labels the sender as external. The Hacker News notes that attackers are increasingly putting the victim's own domain or company name into them.

Step three is the voice call and remote access. Once the victim replies, the fake technician often switches to a Teams voice call and asks the victim to install remote access software. Help Net Security says Microsoft's built-in Quick Assist is the most common choice, and that commercial tools such as AnyDesk and ScreenConnect also appear, often as a second way in that remains after the first is removed. These are legitimate products that real IT teams use, so their presence on a machine is not suspicious by itself. Once the attacker has a remote session, the victim has effectively handed over the keyboard. Arctic Wolf notes that the attackers generally avoid pasting links into Teams, where they would be scanned, and instead download the payload themselves during the remote session.

The Hacker News headline describes the end result as malware and ransomware deployment, and Help Net Security says some of the intrusions ended with data theft and ransomware. Arctic Wolf frames the chat itself as an initial access technique: a way in that can then be used for whatever the operator wants next.

The infrastructure is getting more polished

Many of these scams have relied on free onmicrosoft.com tenants, which can be created quickly and thrown away. According to Help Net Security, Arctic Wolf has seen a recent shift toward paid top-level domains for tenant creation. Of the paid domains identified over the past few months, about 50 percent of the fake identities used the .top top-level domain and about 40 percent used a standard .com domain.

The display names are evolving too. Help Net Security reports that more than 100 names included emoji such as shields and wrenches, which Arctic Wolf believes may indicate that AI tools are being used to create the identities. Some names were written in the target's local language. The likely effect is volume and variety, so that blocking one name or tenant does little to slow the operation.

Help Net Security also points out an overlap with earlier reporting: Sophos documented a Chaos ransomware campaign in which attackers moved away from throwaway onmicrosoft.com tenants and toward IT-themed .top domains. The Hacker News says the activity aligns with a cluster Sophos tracks as STAC4749. That is a similarity reported by the outlets and by Arctic Wolf. Readers should not read it as proof that one group is behind all 400-plus incidents, which the research does not attribute to a single actor.

Why this keeps working

The scheme works on people's expectations. Arctic Wolf notes that employees are generally trained to treat email with suspicion, but a message that shows up inside the company's own Teams environment tends to get around that caution. Teams feels like the internal office. A message there, arriving just as the inbox has fallen apart, from a sender with "IT Support" and the company name in its title, reads as help arriving on time.

The repetition Arctic Wolf describes, with the same tenants, names, tools and domains across hundreds of cases, suggests a playbook that is being reused because it works. It also means the warning signs are consistent enough to defend against. Help Net Security adds that attackers often contact several users within a window of about five minutes, likely through automation, and that malicious code can start running in under 15 minutes once someone engages, so there is little time to react after the first message.

What It Means for Defenders

Who is affected: Any organization on Microsoft 365 with Teams external access left at its default setting. Because no vulnerability is involved, there is no patch and no fixed version. The fixes are configuration, monitoring and training.

Review external access. The research says this technique depends on federation being on by default, and that most organizations have no need to accept chats from any outside tenant. Administrators should decide whether their users actually need to chat with any Microsoft 365 tenant in the world. Arctic Wolf recommends allowing external chats only with specific partner domains, and also advises blocking unmanaged Teams accounts and trial tenants. Pay particular attention to unknown onmicrosoft.com tenants and to newly seen domains on low-cost TLDs such as .top, since both feature heavily in the incidents described.

Make external contacts obvious. Teams labels these senders as external, but the "(Internal)" suffix and IT-style names are designed to undermine that warning. Make sure users know what the external label looks like and that it means "not your IT department." A display name containing your company name is not proof of anything.

Treat a sudden spam flood as a security event. A burst of hundreds of newsletter confirmations is the opening move of this attack, not just a nuisance. Help desks and SOC teams should treat mail bombing as a possible precursor and contact the affected user first, through a known channel, to warn them that an impersonation attempt may follow.

Control remote access tools. Quick Assist was the most common tool in the research, with AnyDesk, ScreenConnect and several other remote support products also seen. Arctic Wolf advises limiting Quick Assist and other remote access software to authorized IT staff. Inventory which remote support products your organization officially uses, restrict or block the rest where you can, and alert on new installations or first-time sessions, especially when they come shortly after a Teams call with an external party.

Give staff one simple rule. Publish how your real IT team will contact people and how it will never contact them. A rule like "IT will never message you from an outside Teams account or ask you to install remote access software during an unscheduled call" is easy to remember and directly counters this script. Give users an easy way to check: a known help desk number or ticket portal they can use before agreeing to anything.

Hunt for the pattern. If you have Teams and endpoint telemetry, look for the combination the research describes: a mail-bombing spike, followed by a chat or call from an external tenant with an IT-style display name, followed by a remote access tool launch on the same user's machine. Any one of these alone may be harmless. All three together deserve an immediate response. Arctic Wolf also notes that credential theft alerts sometimes fired at the same time as the first Teams chat alert, so treat that first alert as urgent.

For small businesses and federal contractors working through CMMC, this is also a good test of whether your access control and awareness training cover collaboration platforms and not just email. An attacker who never sends a phishing link still got in through a door that was open by default.

Sources