--- title: Beyond the Inbox: How Threat Actors Abuse Microsoft... description: Arctic Wolf analyzed over 400 incidents where attackers abused Microsoft Teams' default-on external chat (federation) feature for initial access. Attackers... canonical: https://daily.dev/posts/beyond-the-inbox-how-threat-actors-abuse-microsoft-teams-external-chat-for-initial-access-plsjdfn53 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access | daily.dev og:description: Arctic Wolf analyzed over 400 incidents where attackers abused Microsoft Teams' default-on external chat (federation) feature for initial access. Attackers... og:url: https://daily.dev/posts/beyond-the-inbox-how-threat-actors-abuse-microsoft-teams-external-chat-for-initial-access-plsjdfn53 og:image: https://api.daily.dev/og/posts/PlSJDFn53.png og:image:alt: Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access **[Arctic Wolf](https://daily.dev/sources/arcticwolf)** · 16 min read · 0 upvotes · 0 comments ## Summary Arctic Wolf analyzed over 400 incidents where attackers abused Microsoft Teams' default-on external chat (federation) feature for initial access. Attackers create throwaway tenants, often default *.onmicrosoft.com domains (30 to 40 percent of cases), with IT-themed names like 'IT Support (Internal)' to impersonate help desks. About 50 percent of paid-domain cases used .top TLDs. Attacks often follow mail bombing and move victims to Quick Assist, AnyDesk, or other RMM tools, reaching payload execution in under 15 minutes. Arctic Wolf detects the activity at the Teams 'ChatCreated' event stage and recommends restricting external access to an allow-list of trusted domains. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How are attackers using Microsoft Teams external chat to gain initial access to networks? Attackers create throwaway Microsoft 365 tenants, often using the free *.onmicrosoft.com domain, then message employees via Teams external chat posing as IT support, appending labels like '(Internal)' to the display name. This is often preceded by mail bombing to create urgency. Victims are then guided to install remote access tools such as Quick Assist or AnyDesk, with attackers reaching payload execution in under 15 minutes in observed cases. _Security teams hardening Microsoft 365 against social engineering can track emerging Teams abuse patterns on daily.dev._ ### What percentage of malicious Microsoft Teams tenants use the default onmicrosoft.com domain versus paid domains? Between 30 to 40 percent of analyzed cases involved default *.onmicrosoft.com tenant domains, which require no verification and can be provisioned within minutes. Among cases using paid top-level domains, roughly 50 percent used .top domains, around 40 percent used standard .com, and just over 5 percent used multi-level domains like .com.pl, .com.vn, and .com.br. _Anyone building domain allow-lists for Teams federation can follow attacker infrastructure trends like these on daily.dev._ ### Which remote access tools do attackers most commonly push after compromising a victim through Microsoft Teams? Quick Assist is the most frequently used tool because it is built into Windows, signed by Microsoft, requires no installation, and needs only a six-digit code from the victim. When persistence is needed, attackers pivot to commercial RMM tools including AnyDesk, Atera, ScreenConnect, TeamViewer, Zoho Assist, NetSupport, or LogMeIn. _IT teams restricting remote-access tooling can stay current on abused RMM software via daily.dev._ ## Similar posts on daily.dev - [When “Hi, This Is IT” Comes Through Microsoft Teams](https://daily.dev/posts/when-hi-this-is-it-comes-through-microsoft-teams-teyqlhqzj) · Unit 42 · 0 upvotes · 0 comments - [Microsoft Teams vishing attacks lead to Chaos ransomware attacks](https://daily.dev/posts/microsoft-teams-vishing-attacks-lead-to-chaos-ransomware-attacks-psplrshuw) · BleepingComputer · 0 upvotes · 0 comments - [Identity Abuse Through Trusted Communication Channels](https://daily.dev/posts/identity-abuse-through-trusted-communication-channels-a3zcgqrv1) · Unit 42 · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/beyond-the-inbox-how-threat-actors-abuse-microsoft-teams-external-chat-for-initial-access-plsjdfn53) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access","url":"https://daily.dev/posts/beyond-the-inbox-how-threat-actors-abuse-microsoft-teams-external-chat-for-initial-access-plsjdfn53","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/beyond-the-inbox-how-threat-actors-abuse-microsoft-teams-external-chat-for-initial-access-plsjdfn53"},"datePublished":"2026-10-26T12:59:23.133Z","dateModified":"2026-10-26T13:00:24.580Z","description":"Arctic Wolf analyzed over 400 incidents where attackers abused Microsoft Teams' default-on external chat (federation) feature for initial access. Attackers...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c051a4fc1f751ea067639bfdd16b109a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c051a4fc1f751ea067639bfdd16b109a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Arctic Wolf","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Arctic Wolf","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/30920b37616d4d80ad2b810a4b9f6b2e","url":"https://daily.dev/sources/arcticwolf"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/beyond-the-inbox-how-threat-actors-abuse-microsoft-teams-external-chat-for-initial-access-plsjdfn53","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,phishing","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Arctic Wolf","item":"https://daily.dev/sources/arcticwolf"},{"@type":"ListItem","position":3,"name":"Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/beyond-the-inbox-how-threat-actors-abuse-microsoft-teams-external-chat-for-initial-access-plsjdfn53#faq","mainEntity":[{"@type":"Question","name":"How are attackers using Microsoft Teams external chat to gain initial access to networks?","acceptedAnswer":{"@type":"Answer","text":"Attackers create throwaway Microsoft 365 tenants, often using the free *.onmicrosoft.com domain, then message employees via Teams external chat posing as IT support, appending labels like '(Internal)' to the display name. This is often preceded by mail bombing to create urgency. Victims are then guided to install remote access tools such as Quick Assist or AnyDesk, with attackers reaching payload execution in under 15 minutes in observed cases. Security teams hardening Microsoft 365 against social engineering can track emerging Teams abuse patterns on daily.dev."}},{"@type":"Question","name":"What percentage of malicious Microsoft Teams tenants use the default onmicrosoft.com domain versus paid domains?","acceptedAnswer":{"@type":"Answer","text":"Between 30 to 40 percent of analyzed cases involved default *.onmicrosoft.com tenant domains, which require no verification and can be provisioned within minutes. Among cases using paid top-level domains, roughly 50 percent used .top domains, around 40 percent used standard .com, and just over 5 percent used multi-level domains like .com.pl, .com.vn, and .com.br. Anyone building domain allow-lists for Teams federation can follow attacker infrastructure trends like these on daily.dev."}},{"@type":"Question","name":"Which remote access tools do attackers most commonly push after compromising a victim through Microsoft Teams?","acceptedAnswer":{"@type":"Answer","text":"Quick Assist is the most frequently used tool because it is built into Windows, signed by Microsoft, requires no installation, and needs only a six-digit code from the victim. When persistence is needed, attackers pivot to commercial RMM tools including AnyDesk, Atera, ScreenConnect, TeamViewer, Zoho Assist, NetSupport, or LogMeIn. IT teams restricting remote-access tooling can stay current on abused RMM software via daily.dev."}}]} ```