Hackers Exploit Microsoft Teams Default Settings for IT Support Scam

Cybersecurity researchers at Arctic Wolf have uncovered a sophisticated social engineering campaign that weaponizes everyday workplace tools and default platform configurations. The multi-step attack begins with threat actors inundating a target's corporate email inbox with hundreds or even thousands of spam messages within a very brief window. This deliberate flood of junk mail aims to bury legitimate messages and disorient the employee before the next phase of the assault unfolds.

Shortly after the email barrage, the targeted worker receives a message or audio call via Microsoft Teams from an account disguised as the internal IT service desk. Using convincing displays with names like Ethan or Liam, the impersonators claim knowledge of the ongoing email disruption and offer immediate assistance. To fix the fabricated issue, the fake IT support agents convince the victim to grant hands-on device access through built-in utilities like Windows Quick Assist, which requires no external installation and bypasses suspicion.

Once inside the system, the attackers quickly deploy commercial remote monitoring and management tools such as AnyDesk or ScreenConnect to establish persistent secondary control channels. Investigators note that the entire operation relies heavily on default Microsoft Teams federation settings, which permit open communication across different cloud tenants unless explicitly restricted by corporate administrators. Security experts advise organizations to disable unrestricted external chat, transition to a curated allow-list of trusted business partners, and reinforce employee training to counter these impersonation tactics.