We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

Teams external chat abused to pose as IT support, Arctic Wolf finds

A default Teams setting lets people outside your organisation message your staff, and attackers use it to pose as the help desk.

Arctic Wolf published research on 26 October 2026 about attackers who message staff through Microsoft Teams external chat while posing as IT support. It analysed more than 400 of these incidents.

Attackers flood the inbox, then offer to fix it

Teams has external access turned on by default. A user in another Microsoft 365 organisation can find, chat with and call your staff, if both sides allow external access. Arctic Wolf says the attacks exploit no known Teams flaw. They abuse that normal feature.

In many cases the victim's inbox is first flooded with hundreds of newsletter or subscription emails within minutes. A Teams message from "IT support" then arrives and offers to fix the problem the attacker made.

The attackers add "(Internal)" to their display name, although Teams labels the sender as External.

How the Teams attack runs, as Arctic Wolf describes it

  1. The inbox flood Hundreds of newsletter or subscription emails arrive within minutes.
  2. The Teams chat A fake IT support account offers to fix the flood.
  3. Remote access The victim lets the attacker in, most often through Quick Assist.
  4. The attacker's code runs In under 15 minutes from the moment the victim engages.
The order of events in the incidents Arctic Wolf studied. Not every attack used every step.

Quick Assist gives attackers access within minutes

Quick Assist was the remote access tool the attackers used most often. Arctic Wolf says this may be because it is built into Windows and needs no installation. The victim only has to read back a six-digit code.

Once a victim engaged, the reports from Arctic Wolf's customers show the attackers running their code in under 15 minutes.

Teams admins can limit who reaches staff

The settings are in the Teams admin center, under Users, then External access. Microsoft's default lets staff talk to people in any external domain.

Arctic Wolf advises choosing "Allow only specific external domains" and adding only the partners the organisation works with. Microsoft confirms that once an allow list is set up, all other domains are blocked.

Microsoft says chats with trial-only tenants, which have no paid licences, are blocked by default. Admins who allow chats with unmanaged Teams accounts can still stop those accounts from starting a chat.

Arctic Wolf also advises limiting Quick Assist to authorised IT roles, or removing it where nobody uses it. It advises blocking remote access tools that the organisation has not approved.

Settings Arctic Wolf and Microsoft point to

  • Allow only specific external domains, and list only your partners.
  • Check that chats with trial-only tenants are still blocked.
  • Decide whether unmanaged Teams accounts may start chats with your staff.
  • Limit Quick Assist to authorised IT roles, and block unapproved remote access tools.
Arctic Wolf's advice, checked against Microsoft's Teams admin documentation.

Staff need to know how real IT support gets in touch

Arctic Wolf advises telling staff exactly how real IT support contacts them, and that an unexpected external "IT support" chat is suspicious.

In the UK, the NCSC advises checking important requests through a second type of communication, such as a phone call. It also says no training package, phishing simulations included, can teach people to spot every attempt.

Read next

Sources

  1. arcticwolf.com, Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access, Arctic Wolf, checked 27 October 2026
  2. learn.microsoft.com, IT Admins, Manage external meetings and chat with people and organizations using Microsoft identities, Microsoft Teams, Microsoft Learn, checked 27 October 2026
  3. NCSC, Phishing attacks: defending your organisation, checked 27 October 2026

This is an independent editorial guide, not legal advice.