The Teams Helpdesk Hijack: How Attackers Weaponize External Federation to Deploy Ransomware

The Fake Helpdesk Trap: How External Teams Chats Bypass Corporate Email Filters

Corporate security teams have spent two decades building deep moats around employee email. Inbound messages pass through SPF, DKIM, and DMARC checks, followed by behavioral machine learning filters, natural language analysis, and attachment sandboxes. When a malicious email hits an inbox today, there is a strong probability it gets flagged or quarantined before an end user clicks a link.

Attackers know this, which is why they have shifted their focus to enterprise collaboration tools. Over recent months, telemetry published by Arctic Wolf Labs reveals a sharp spike in threat groups weaponizing Microsoft Teams external federation. Rather than attempting to break through an hardened corporate Exchange gateway, threat actors set up fresh, disposable Microsoft 365 tenants and message employees directly through Teams chat.

The attack relies on psychological timing and architectural trust. It typically begins with a high-volume “mail bomb.” The victim receives hundreds of automated newsletter sign-ups, form submissions, and subscription confirmations within minutes. As their Outlook client dings uncontrollably, the employee becomes stressed and confused.

Right on cue, a message pops up inside Microsoft Teams. The sender displays a name such as IT Support (Internal) or Helpdesk Support - Urgent Ticket. The profile picture looks clean, and the persona offers immediate help to resolve the email flooding. Because the message lands inside the same application where the employee chats with colleagues, managers, and project teams every day, the corporate guard goes down. The victim assumes internal IT caught the anomaly and reached out to fix it.

In reality, the message originates from an entirely separate, rogue Microsoft 365 tenant. The attacker did not compromise an internal account; they simply leveraged Microsoft Teams’ default configuration, which permits users from external tenants to initiate chats unless administrators explicitly restrict federation. By moving the conversation from email to chat, the attacker completely bypasses the organization’s secure email gateway (SEG), establishing an unfiltered, real-time communications channel straight to an authorized workstation.

40% Default Fallbacks and 50% Top-Level Domains: Breaking Down the Attacker Infrastructure

The technical backbone of these impersonation campaigns reveals a blend of cheap, expendable cloud assets and disposable domain infrastructure. Attackers are not investing heavily in mature, aged domains. Instead, they exploit automated Microsoft provisioning quirks and ultra-low-cost generic top-level domains (gTLDs).

According to forensic investigations across hundreds of intrusions, roughly 30% to 40% of the attacking identities originate from raw *.onmicrosoft.com domains. When anyone creates a new Microsoft 365 tenant, Microsoft assigns a permanent fallback domain under this namespace. Threat actors spin up trial subscriptions using names tailored to mimic corporate help desks, such as helpdesk-support-tier2.onmicrosoft.com or global-it-service-desk.onmicrosoft.com.

When attackers do purchase custom domains to link to their Microsoft 365 tenants, they favor disposable options. Data indicates that approximately 50% of paid domains tied to these operations use the cheap .top top-level domain, roughly 40% use standard .com names, and roughly 5% leverage regional multi-level ccTLDs such as .com.pl or .com.br. The threat cluster tracked as STAC4749, for example, consistently registers IT-themed .top domains paired with plausible employee monikers to create believable outbound profiles.

Crucially, the threat actors almost never paste malicious URLs or direct download links directly into the Microsoft Teams chat window. Doing so would trigger Microsoft Defender for Office 365 features, such as Safe Links and Zero-hour Auto Purge (ZAP), which scan and neutralize known malicious URLs in real time.

Instead, the attackers keep the chat text entirely benign. They use natural, reassuring conversational language to convince the victim to launch a remote access utility. Once inside the desktop session, the attacker browses directly to their payload staging site or runs terminal commands manually, rendering automated chat-content security tools completely blind to the intrusion.

Three Ways Compromised Teams Sessions Derail Enterprise Infrastructure

When an attacker successfully maneuvers an employee from a Teams chat into a screen-sharing session, the blast radius widens rapidly. This is not a simple credential-harvesting incident that can be fixed with a password reset. It is a full hands-on-keyboard workstation takeover.

1. Exploitation of Legitimate Remote Management Software (Living off the Land)

Once an employee believes they are speaking with genuine internal IT staff, the threat actor directs them to open a legitimate Remote Monitoring and Management (RMM) tool. Attackers regularly abuse native Windows tools like Quick Assist, or instruct the user to download standard commercial tools including AnyDesk, ScreenConnect (ConnectWise), TeamViewer, Atera, Zoho Assist, NetSupport, or LogMeIn.

Because these applications are legitimate, digitally signed administrative utilities, basic antivirus tools rarely flag their execution. Endpoint Detection and Response (EDR) agents may log the process creation, but without strict behavioral policies against unmanaged RMM usage, security operations centers (SOCs) treat the event as regular IT support activity. Once the session code is shared, the attacker obtains full mouse and keyboard control without writing a single line of custom exploit code.

2. Deep Active Directory Enumeration and Privilege Traversal

With desktop access established, the threat actor acts quickly to maintain persistence before the user becomes suspicious. In documented cases, attackers instructed the user to execute a PowerShell command or executed it directly in the background. The command pulls an MSI installer hosted on Microsoft Azure Blob Storage.

When executed, the MSI installer unpacks an embedded Python implant. This backdoor immediately triggers secondary transactions that launch LDAP queries against the corporate Active Directory. The queries harvest detailed listings of all computer objects, domain controllers, service accounts, and administrative users, transmitting the mapped directory structure to an attacker-controlled external command-and-control server. What began as an unsolicited chat turns into complete internal domain reconnaissance in under fifteen minutes.

3. Lateral Backdoor Staging and Chaos Ransomware Deployment

To ensure they do not lose access if the user reboots or closes the remote support window, attackers deploy secondary, stealthier RMM tools—such as Level—or plant the GoGRPC backdoor. From there, they move laterally across local subnets toward core server infrastructure and backup repositories.

According to threat telemetry from Sophos and Arctic Wolf, several of these intrusion paths ultimately culminate in the execution of the Chaos ransomware family. Attackers exfiltrate sensitive files via the established command-and-control channels, terminate local backup and volume shadow copy services, and encrypt local and mapped network drives. The enterprise faces operational downtime, extortion demands, and mandatory data breach notifications, all stemming from an unauthenticated chat message.

Cutting Off External Federation and Hardening RMM Execution Barriers

Defending against this attack path requires closing the architectural gap between email controls and instant messaging policies. Organizations cannot rely on employee discretion alone to spot fake IT technicians. Effective mitigation requires technical guardrails that limit unexpected external communication and restrict unauthorized remote desktop utilities.

The most direct and cost-free defensive measure is reconfiguring Microsoft Teams external access policies. In the Microsoft Teams Admin Center, administrators should review the “External access” settings. By default, organizations are frequently configured to allow communication with all external domains. Switching this setting to an explicit allowlist—permitting federation only with vetted business partners and trusted vendors—immediately eliminates unsolicited chats from disposable *.onmicrosoft.com and .top tenants.

Organizations that must maintain broad collaboration can implement centralized telemetry monitoring. Platforms like Datadog can ingest and analyze audit logs from Microsoft 365, endpoint telemetry, and network gateways. Correlating high-volume email spikes (mail bombing) with immediate process launches of quickassist.exe, AnyDesk.exe, or outbound connections to unauthorized RMM relay servers provides SOC analysts with early, high-fidelity intrusion alerts.

Simultaneously, desktop engineering teams must enforce strict application control policies using Windows Defender Application Control (WDAC) or AppLocker. Removing or disabling native tools like Quick Assist on standard corporate laptops stops the attacker’s preferred path dead in its tracks. If an IT support technician genuinely needs remote access, the connection should occur exclusively through an enterprise-managed, pre-authenticated support platform integrated with corporate single sign-on (SSO).

Practical Risk Mitigation and Crisis Response Defense Lines

To protect enterprise operations from Teams-based impersonation schemes and the subsequent deployment of Chaos ransomware, security leadership should implement a structured, two-tier defense framework.

Tier 1 Defense: Immediate Tenant Federation and Quick Assist Lockdowns

The primary defense line focuses on stopping the attacker’s ability to reach employees and immediately cutting off their easiest interactive tooling:

• Audit Microsoft Teams External Access Settings: Access the Microsoft Teams Admin Center (Users > External access). Disable the global “Allow all external domains” setting. Transition to a closed model where external domains must be reviewed and approved. If full closure is operationally impossible, explicitly block known fallback domains (such as *.onmicrosoft.com) and high-risk top-level domains like .top.
• Enforce Clear External Messaging Banners: Verify that external chat tagging is active and visible across desktop and mobile Teams clients. Train staff that any chat displaying an external badge claiming to be “Internal IT” is an immediate security incident that should be reported through a dedicated phishing button.
• Block Unapproved Remote Support Tools: Use Microsoft Intune, Group Policy, or local configuration scripts to uninstall or block the execution of Microsoft Quick Assist (quickassist.exe) for standard, non-administrative user profiles. Maintain an explicit application allowlist that prevents standalone binaries for AnyDesk, ScreenConnect, and TeamViewer from executing out of the C:\Users\*\AppData directory.
• Establish an Out-of-Band IT Verification Standard: Institute a strict operational policy: internal IT support will never initiate unsolicited screen-sharing sessions via Teams chat without an existing, employee-generated helpdesk ticket. Require employees to verify technician identities via an internal directory phone call before granting screen control.

Tier 2 Defense: Identity Telemetry and RMM Application Control Redesign

The secondary defense line builds resilient monitoring and detection capabilities to catch intruders who manage to establish an interactive session:

• Correlate Mailbox Influx with Process Spawns: Build automated detection rules in your security analytics platform that flag accounts receiving more than 100 inbound emails within a five-minute window. If that same user account subsequently launches an unmanaged communication or administrative tool within the next 30 minutes, trigger an automated host isolation protocol.
• Monitor LDAP Query Bursts from Non-Administrative Endpoints: Configure endpoint agents to monitor for abnormal Active Directory enumeration. Standard user workstations should rarely query the domain controller for complete lists of all domain computers and user objects. Flag or terminate any user-spawned process that triggers bulk LDAP discovery transactions.
• Restrict PowerShell and Script Execution: Ensure PowerShell Constrained Language Mode is enabled for non-privileged accounts. Block standard users from running unvetted MSI packages downloaded directly from external cloud storage locations like Azure Blob (*.blob.core.windows.net) or Amazon S3 buckets.
• Audit Backup Redundancy and Shadow Copies: Ensure critical file servers and directory databases maintain immutable, off-site backups that cannot be wiped or encrypted via compromised domain administrative credentials. Periodically test cold-restore procedures to verify recovery timelines in the event of an aggressive Chaos ransomware deployment.