Arctic Wolf analyzed more than 400 incidents where attackers used Teams external access (on by default) to message staff as help desk. No Teams bug is involved. Victims who engage reached payload execution in under 15 minutes.

1. First contact: hunt ChatCreated events from external tenants, especially one-on-one chats. Arctic Wolf says this is the best detection point, before the user acts. Look for display names like "IT Support (Internal)", "IT Service Desk – Liam", "HelpDesk Supervisor", emoji such as 🛡/🛠, or your own company name.
2. Tenants: 30-40% came from default *.onmicrosoft.com tenants with IT-themed names (e.g. helpdeskteam365, itendpoint365, itcoreportal). Paid domains are shifting to .top (about half), then .com and .com.br/.com.vn/.com.pl. Flag a tenant that messages many of your users within about five minutes.
3. Lead-in: correlate with mail bombing (hundreds of newsletter sign-up confirmations in minutes) shortly before the chat.
4. Hands-on access: QuickAssist.exe/msra.exe (the most common), then AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport, LogMeIn, or Level installed by msiexec for a second channel. Attackers avoid pasting links in Teams, so Safe Links won't catch the payload; watch the endpoint.
5. One observed chain: PowerShell under explorer.exe pulls an MSI from Azure Blob Storage, which drops cleaner.ps1 into AppData\Local\PowershellCleaner\scripts, then runs pythonw.exe with ss.py that runs adsisearcher LDAP queries for all users and computers. Some cases had Kerberoasting alerts firing alongside the chat alert.

Reduce exposure: limit Teams external access to an allowlist of partner domains, and block or alert on unsanctioned RMM tools. Related: Sophos ties the .top tenant pattern to STAC4749 and Chaos ransomware.