Attackers use Teams support impersonation to gain remote access and deploy ransomware

Attackers have used Microsoft Teams external chats to impersonate IT support across hundreds of cases, Arctic Wolf Labs reported. Victims often receive hundreds of subscription emails before a supposed support worker contacts them and persuades them to grant access through legitimate remote-access software. Arctic Wolf observed attackers increasingly adding the target company's name to display names. During remote sessions, attackers often navigate to malicious downloads themselves rather than paste links into Teams, avoiding message-based link scanning. Intrusions have included reconnaissance, data theft and ransomware deployment. The attacks target organizations with external access enabled and exploit trust rather than a software vulnerability.