Microsoft Teams is the new front door for attackers, and they’re posing as your help desk
For a decade, security teams trained employees to distrust email. Attackers moved to the tool employees trust most. Arctic Wolf’s October 26 report, Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access, documents more than 400 incidents in which attackers posed as IT support and talked staff into handing over their machines. No vulnerability was exploited. Teams worked exactly as designed.
How the attack unfolds
The attacker registers an external Microsoft 365 tenant, often on a default onmicrosoft.com domain (30 to 40 percent of cases), then buries the target under hundreds of newsletter confirmations. Minutes later, a Teams message from “IT Support (Internal)” offers to fix the flood. Teams labels the sender external, but a familiar name and a real problem usually win. A voice call follows, and the victim activates Quick Assist, AnyDesk or ScreenConnect. Quick Assist ships with Windows and is signed...
Copyright of this story solely belongs to www.expresscomputer.in. To see the full text click HERE
