Return to Threats

Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware

thehackernews.com 2026-10-26 malicious AI use High
Run AI Security Assessment Talk to AI CISO

Executive Summary

Attackers are reportedly abusing Microsoft Teams external chats for IT-support impersonation scams and malware or ransomware delivery. Security, IT, and AI governance teams should review external communication and social-engineering exposure.

What Happened

Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malware. "A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same 'IT

Affected Products

  • Microsoft Teams

Vulnerability / Attack Technique

Social engineering and impersonation

Technical Mechanism

Threat actors create or use external Microsoft Teams chats to impersonate IT support or deliver malware. The reported incidents share recurring infrastructure and behavioral patterns, including the use of throwaway tenants.

AI Security Category

AI-assisted attack

Part of the AI-Assisted Attacks topic.

Relevant Frameworks

MITRE ATLAS: Initial AccessMITRE ATLAS: ExecutionMITRE ATLAS: Impact

RealGround Analysis

Although the reported activity does not describe an attack against an AI or LLM system, the same impersonation and external-channel abuse could target teams operating AI agents or LLM applications. AI security programs should include human-facing collaboration platforms in threat modeling and red-team scenarios.

Recommended Controls

  • Restrict or require approval for external Microsoft Teams chat creation.
  • Verify IT-support identities through an independent trusted channel before taking action.
  • Block or quarantine unexpected links, files, and software delivery through external chats.
  • Monitor for repeated use of suspicious external tenants and anomalous support-related conversations.
  • Include collaboration-platform impersonation scenarios in AI agent and LLM application red-team exercises.

Related RealGround Service

AI CISO Advisory · or start with the free AI Agent Security Scanner.

Sources

thehackernews.com: https://thehackernews.com/2026/10/attackers-use-microsoft-teams-it.html

Summary and analysis written by RealGround from the source above; last updated 2026-10-27.

Talk to AI CISO