Microsoft Teams external access is on by default. Any user in another Microsoft 365 tenant can find, chat with and call employees in your organisation, provided both tenants allow external access. Arctic Wolf examined more than 400 incidents in which attackers used that default to open a conversation as an IT support agent and finish with remote control of the victim's machine, in under 15 minutes from the first reply.

The research was published on October 26, 2026. The attackers often contacted several victims within a short window, which the researchers read as automation. Arctic Wolf did not identify the operators, but noted that external Teams chat as an initial access route has been used by ransomware groups including Black Basta.

The tenant is the disguise

Between 30 and 40 percent of the cases involved default onmicrosoft.com tenant domains. Those need no verification and can be provisioned in minutes. The attackers typically chose a tenant name built from a support, IT, admin, network or helpdesk word, sometimes with the number 365 appended, and paired it with a plausible first name so the sender appeared as "IT Service Desk - Liam" or similar.

In a small number of cases a real company name appeared in the sender's tenant name, which raises the cost of the decision for the recipient: the external tag is still there, but the name is familiar.

In a significant number of attacks the victim's mailbox was first flooded with hundreds of newsletter or subscription confirmations within minutes. That mail bombing gives the attacker a problem to solve. The Teams message arrives moments later, offering to fix the noise.

From chat to keyboard

Most cases moved to hands-on-keyboard access through remote monitoring and management tooling, most often Quick Assist, which ships with Windows and needs no installation. Where the attacker wanted persistence beyond the first call, the pivot went to a commercial RMM product such as AnyDesk or ScreenConnect.

From there, the observed chain is a PowerShell payload and lateral movement, in some cases toward ransomware deployment. In several incidents the user was talked through running a PowerShell command and launching a downloaded file.

The fifteen-minute figure is not the whole intrusion. It is the distance between the victim engaging with the message and the payload executing. A control that depends on a user pausing to think has to work inside that window, on a channel the user has no reason to distrust.

The controls that actually address the route

Arctic Wolf's recommendations map to distinct failure points, and they are worth reading as a sequence rather than a list.

External access is the route. In the Teams admin center under Users and External access, the setting to allow only specific external domains restricts chat to named partner domains. Blocking chat with unmanaged and Teams-consumer accounts, and disabling the option that lets unmanaged users start conversations with your people, closes the case where the sender has no managed tenant to check. Blocking federation with trial-only tenants removes the cheapest infrastructure an attacker can buy. Enabling the security team's ability to manage blocked domains gives responders a way to act during an incident instead of after it.

Quick Assist is the execution path. Restricting it to authorised IT roles, and blocking or uninstalling unsanctioned RMM tools, removes the tool the attacker asked the user to trust. This control is the one that survives a failed awareness programme, because it does not depend on the user recognising the pretext.

User reporting is the detection path. Microsoft's end-user reporting in Teams lets an employee report a suspicious message or an external user in two clicks. That matters most for the first contact, before any payload exists to detect.

What the external tag does not prove

A banner that says External tells the user that the sender is outside the tenant. It does not tell them the sender is not the IT department, because a tenant name and a display name are chosen by the attacker. Training that explains how real IT support contacts users, and what domain a message comes from, addresses the gap that the tag leaves open. Training alone does not, which is why the RMM restriction sits in front of it.

The scale in this research is the argument for treating chat as an ingress path. Four hundred incidents in a single vendor's customer base, with consistent tradecraft and short dwell time, is a campaign rather than a nuisance. Each of them started with a message that the platform was designed to deliver.

References

[1] Infosecurity Magazine, "Attackers Exploit Teams External Chat to Breach Organizations in Under 15 Minutes", October 27, 2026. https://www.infosecurity-magazine.com/news/exploit-teams-chat-breach/