Teams Spam Attack: Hackers Exploit Default Settings

Cybersecurity researchers have identified a widespread hacking campaign targeting organizations by exploiting Microsoft Teams' default settings. The attack begins with an overwhelming influx of spam emails designed to bury legitimate messages, making it difficult for users to discern important communications.

Shortly after the spam barrage, attackers impersonate IT support through Microsoft Teams, sending messages or initiating calls. These actors convincingly offer to resolve the email issues, a common tactic to gain the victim's trust. They then persuade the victim to grant remote access to their device.

The attackers leverage legitimate remote access tools, including Windows' built-in Quick Assist, AnyDesk, or ScreenConnect. This method requires minimal technical skill from the attacker and no installation of suspicious software for the victim, increasing its effectiveness. The default external access (federation) feature in Microsoft Teams is a key enabler, allowing external users to message internal employees.

Once access is established, attackers often install commercial Remote Monitoring and Management (RMM) tools to ensure persistent control. They then conduct network reconnaissance, likely in preparation for deploying malware or ransomware. Organizations are advised to restrict external Teams access to trusted contacts and educate employees about these social-engineering tactics.