Microsoft Teams scams are being used to push malware
Oct 26, 2026 · Summarized by Fundy Tech from The Hacker News
Attackers are using Microsoft Teams external chat to pose as IT support and deliver malware or ransomware. The scams rely on throwaway tenants, fake support names and remote access tools.
Key points
- Arctic Wolf says it has seen the pattern across hundreds of cases.
- Many scams use newly created Microsoft 365 tenants and .onmicrosoft.com domains.
- Victims are often pushed toward tools like Quick Assist, AnyDesk and TeamViewer.
Why it matters
Businesses that allow external Teams chat can be exposed to convincing support scams. Staff may be tricked into giving remote access or running malware. Households using work devices at home should be careful with unexpected IT messages and urgent requests.
Who’s affected: Microsoft Teams users and organisations with external chat enabled
What to do
- Verify IT support requests through a separate channel.
- Do not grant remote access to unsolicited callers.
- Watch for mail bombing before suspicious Teams messages.
- Train staff to report fake support contacts.
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.