Microsoft Teams External Chat Abuse Enables Scalable Remote Access Attacks

What happened

Threat actors have leveraged Microsoft Teams external chat to create contact channels with employees across multiple organizations. By using throwaway Azure AD tenants and display names that mimic internal IT support, attackers initiate conversations that appear legitimate. The initial contact is followed by a barrage of emails that overwhelm inboxes, a tactic known as email bombing, designed to distract users and lower their guard.

Once the employee engages, the attacker delivers a remote‑access payload via a trusted software channel. The payloads are hosted on domains that recur across incidents, allowing attackers to scale the attack with minimal effort. The combination of impersonation, email flooding, and remote‑access tools creates a repeatable compromise workflow that has been observed in more than 400 cases worldwide.

Who is affected

Any organization that uses Microsoft Teams with external chat enabled is at risk. The attack does not discriminate by industry; it targets enterprises, government agencies, and educational institutions that rely on Teams for collaboration. Employees who receive unsolicited chat requests or email messages from unknown senders become the primary vectors for compromise.

Defenders who have not restricted external chat or who lack proper monitoring of Teams activity are particularly vulnerable. Organizations that rely on legacy remote‑access solutions without MFA or that allow unverified external connections are exposed to the same repeatable attack pattern.

Impact

Successful exploitation grants attackers persistent remote‑access capabilities. Once inside, attackers can move laterally, exfiltrate data, or pivot to other critical systems. The use of trusted software channels masks malicious activity, making detection difficult for traditional endpoint security solutions.

The email bombing component can also cause operational disruption, as legitimate communications are buried under spam. This can delay incident response and increase the window of opportunity for attackers to establish footholds.

Exposure

Attackers rely on the same throwaway tenants and payload domains across incidents, creating a signature that can be tracked. The external chat feature, if left unfiltered, allows attackers to bypass internal identity controls and establish contact with employees before any authentication is required.

Organizations that have not implemented strict Teams policies or that lack visibility into external chat activity are exposed to repeated attempts. The consistent use of the same remote‑access tools and domains means that once a single tenant is compromised, the same attack chain can be reused against other targets.

What to do

Defenders should immediately audit Teams external chat settings in the Teams admin center. Disable external chat for unknown domains and enforce strict guest access policies. Enable multi‑factor authentication for all remote‑access tools and restrict their use to verified accounts only.

Deploy monitoring for email‑bombing patterns by analyzing inbound email volume spikes and unusual attachment types. Use threat‑intelligence feeds to block known malicious payload domains and block throwaway tenant identifiers. Conduct regular phishing awareness training focused on chat impersonation scenarios.

What to watch

Keep an eye on new tenant registrations that use common IT support display names. Monitor for repeated use of the same remote‑access tool signatures across incidents. Watch for sudden increases in Teams chat activity from external users, especially during periods of high email traffic.

Stay updated on Microsoft’s security advisories regarding Teams external chat and remote‑access vulnerabilities. Review the latest threat‑intel reports for emerging payload domains and adjust firewall rules accordingly to prevent outbound connections to known malicious endpoints.