Fake IT Support on Microsoft Teams Is Now a Standard Route to Chaos Ransomware

Teams Vishing Attacks Turn a Chat Window Into Ransomware

On October 26, 2026, security teams faced a scenario that has become depressingly standard: hundreds of vishing attacks via Microsoft Teams external chat, using IT-themed display names, culminating in Chaos ransomware deployment. Arctic Wolf Labs and Sophos have documented a systematic campaign, attributed to group STAC4749, that turns a productivity feature into a privileged-access tunnel. The attack exploits no software vulnerability. It abuses legitimate functionality: Teams external access, commercial remote monitoring and management tools, Azure Blob Storage and PowerShell.

The speed is what should alarm defenders. In one documented incident, attackers went from initial Teams contact to file encryption in under 17 hours. In other cases, customer-reported attack chains reached payload execution in under 15 minutes. That is not a slow intrusion to catch over weeks. It is a same-day incident, and it starts with a chat message that looks like it came from your own help desk.

How Teams Vishing Attacks Work, Step by Step

The setup is a tenant that looks like your help desk. Attackers create or buy Microsoft 365 tenants and send messages through Teams external chat. Arctic Wolf found that 30 to 40 percent of the cases it investigated used onmicrosoft.com, the permanent fallback domain Microsoft generates automatically when a tenant is created. Tenant names are picked to sound internal: helpdeskteam365, itendpoint365, itcoreportal, itadmin922 and corporateitservicellc. Display names do the rest: Help Desk IT Support, IT Service Desk, HelpDesk Supervisor, Enterprise IT and Security (Internal), and IT/Help Desk. In recent versions, attackers add the target's own company name or domain to the display name.

Once a victim engages, attackers commonly request a Teams voice call and guide them into granting remote access through a legitimate remote monitoring tool: Quick Assist was the most frequently observed, alongside AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport and LogMeIn. Quick Assist requires user approval for screen sharing and control, so the attack depends on persuasion, not exploitation. From there, attackers run reconnaissance, deliver payloads like the GoGRPC backdoor, move laterally to domain controllers, and deploy additional remote tools for redundancy, before exfiltrating data and dropping the ransomware binary.

The infrastructure is also getting more professional. Over the past few months, Arctic Wolf saw a move toward paid domains for tenant creation. Among paid-domain cases, about 50 percent of fake identities used the .top top-level domain, around 40 percent used a standard .com, and just over five percent used multi-level domains such as .com.pl, .com.vn and .com.br. Attackers also use more than 100 emoji markers in display names, such as a shield or tools symbol, which Arctic Wolf suggests may indicate AI-assisted creation of identities. In a subset of cases, attackers configured DNS records to redirect web requests to the legitimate Microsoft or victim organisation site, to appear authentic.

Why Message Scanning Alone Misses It

Here is the detail that breaks most defences: the URL never touches Teams. Arctic Wolf notes that attackers generally avoid pasting a URL into Teams, because that would trigger Safe Links and zero-hour auto purge scanning. Instead, they browse to the payload themselves during the remote session. Message scanning alone will miss the step that matters, which is why endpoint and identity telemetry are essential monitoring surfaces alongside message scanning.

Sophos tracked STAC4749 across dozens of North American organisations between February and June 2026, with about 50 percent of cases in Canada and 44 percent in the United States. At least three investigated compromises culminated in encryption. The group is connected to former Black Basta affiliates, with overlapping tooling with FIN7, and the technique itself was industrialised by Black Basta in 2024: flood an inbox with spam, then send a Teams message from fake IT support offering to fix it. The collapse of Black Basta in early 2025 did not kill the technique. Its former affiliates refined it, and by March 2026, 77 percent of incidents targeted executives.

What Defenders Should Actually Do

First, restrict Teams external access. If your organisation does not need external chat with arbitrary tenants, turn it off or allowlist only known partners. That single control breaks this attack chain at the first step. Second, train staff on a simple rule: your real IT team will never cold-contact you on Teams and ask you to install remote access software. If a help desk message arrives uninvited, verify it through a known channel before doing anything, and never grant remote access to an unverified caller.

Third, monitor the right telemetry: external Teams contact events, first-time remote tool installations, PowerShell executions from remote sessions, and LDAP reconnaissance against Active Directory. Fourth, treat remote access tools as privileged software: allowlist the ones you use, alert on the rest, and require approval for new installations. Microsoft has also added controls, including a meeting protection policy to block external bots and a feature to blur QR codes from external senders, and on October 27 it added AI that reads conversations to catch phishing with no malicious links. Those help, but they do not replace the access control.

The lesson of the Teams vishing wave is uncomfortable: the most dangerous vulnerability in many organisations is a helpful employee and a chat feature that was enabled by default. Attackers did not break Teams. They used it exactly as designed, with a fake identity and a confident voice. For the wider ransomware picture, see the SafePay advisory covering 600 organisations and the IDCF Cloud ransomware backup failure. For individuals, the same scepticism applies to phone calls: see our guide on stopping spam calls. When a stranger in a chat window asks for control of your computer, the answer is always no until proven otherwise.