TL;DR

what: Attackers are flooding employee inboxes with junk mail, then messaging them on Microsoft Teams as fake internal IT support from throwaway Microsoft 365 tenants to gain remote access.

impact: Across hundreds of cases tracked by Arctic Wolf Labs, the chats have led to backdoors such as GoGRPC, lateral movement to domain controllers, data exfiltration and, per Sophos, Chaos ransomware.

fix: There is no patch because no software flaw is involved; the mitigation is restricting Teams external access, controlling which RMM tools can run, and watching endpoint and identity telemetry, since attackers avoid URLs that would trigger Safe Links and ZAP scanning.

who: Any organization running Microsoft Teams with external access enabled, especially those whose staff are used to getting help desk support through chat.

An employee's inbox fills with hundreds of newsletter sign-ups and subscription confirmations in a few minutes.…