---
title: Hunt: fake "IT Support (Internal)" Teams chats from outside tenants, often after a mail bomb, then Quick Assist and a pythonw implant. Arctic Wolf saw 400+ cases | ctxsec
url: https://ctxsec.com/items/hunt-teams-external-chat-it-support-arctic-wolf-400-incidents
description: ""
status: "threat research (Arctic Wolf Labs, Oct 26; 400+ incidents)"
published: 2026-10-26
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-teams-external-chat-it-support-arctic-wolf-400-incidents.md)

threat research (Arctic Wolf Labs, Oct 26; 400+ incidents)

2026-10-26

### Hunt: fake "IT Support (Internal)" Teams chats from outside tenants, often after a mail bomb, then Quick Assist and a pythonw implant. Arctic Wolf saw 400+ cases

Arctic Wolf analyzed more than **400 incidents** where attackers used Teams external access (on by default) to message staff as help desk. No Teams bug is involved. Victims who engage reached payload execution in **under 15 minutes**.

1. **First contact:** hunt `ChatCreated` events from external tenants, especially one-on-one chats. Arctic Wolf says this is the best detection point, before the user acts. Look for display names like "IT Support (Internal)", "IT Service Desk – Liam", "HelpDesk Supervisor", emoji such as 🛡/🛠, or your own company name.
2. **Tenants:** 30-40% came from default `*.onmicrosoft.com` tenants with IT-themed names (e.g. `helpdeskteam365`, `itendpoint365`, `itcoreportal`). Paid domains are shifting to `.top` (about half), then `.com` and `.com.br/.com.vn/.com.pl`. Flag a tenant that messages many of your users within about five minutes.
3. **Lead-in:** correlate with mail bombing (hundreds of newsletter sign-up confirmations in minutes) shortly before the chat.
4. **Hands-on access:** `QuickAssist.exe`/`msra.exe` (the most common), then AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport, LogMeIn, or Level installed by `msiexec` for a second channel. Attackers avoid pasting links in Teams, so Safe Links won't catch the payload; watch the endpoint.
5. **One observed chain:** PowerShell under `explorer.exe` pulls an MSI from Azure Blob Storage, which drops `cleaner.ps1` into `AppData\Local\PowershellCleaner\scripts`, then runs `pythonw.exe` with `ss.py` that runs `adsisearcher` LDAP queries for all users and computers. Some cases had Kerberoasting alerts firing alongside the chat alert.

**Reduce exposure:** limit Teams external access to an allowlist of partner domains, and block or alert on unsanctioned RMM tools. Related: Sophos ties the .top tenant pattern to STAC4749 and Chaos ransomware.

Sources: [Arctic Wolf Labs: Beyond the Inbox, how threat actors abuse Microsoft Teams external chat for initial access (Oct 26)](https://arcticwolf.com/resources/blog/threat-actors-abuse-microsoft-teams-external-chat-for-initial-access/)