Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware

Cybersecurity researchers have identified a recurring social engineering pattern where attackers use Microsoft Teams' external chat feature to conduct scams or deliver malware. This pattern has been observed across hundreds of cases. The attackers use impersonation scams, taking advantage of the feature to trick victims. A consistent behavior among the attackers involves using the same temporary Microsoft Teams tenants and pretending to be IT support. The goal of these scams is to deploy malware and ransomware. The researchers have noted a consistent pattern of attacker behavior across these incidents.