Microsoft Teams IT Support Scams Deploy Malware and Ransomware

# Microsoft Teams IT Support Scams Deploy Malware and Ransomware

https://gcdradar.vercel.app/incidents/microsoft-teams-it-support-scams-deploy-malware-and-ransomwa · AIR-2026-1546 · closed 2026-11-10

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Confirmed real-world attack campaign using social engineering and malware deployment.
- Fix status: No fix needed
- First reported: 2026-10-26
- AI role: No AI role
- Products: Microsoft Teams

## Summary

Threat actors are using Microsoft Teams' external chat features and throwaway tenants to impersonate IT support and deploy malware and ransomware. Researchers highlight a recurring social engineering pattern spanning hundreds of confirmed cases.

## What to do

Monitor and restrict external tenant chat access in Microsoft Teams where appropriate.

## Latest updates

- 2026-10-26: Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware (https://thehackernews.com/2026/10/attackers-use-microsoft-teams-it.html)

## Sources

- 2026-10-26 The Hacker News: Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware https://thehackernews.com/2026/10/attackers-use-microsoft-teams-it.html
- 2026-10-27 Dark Reading: External Teams Chats Anchor 15-Minute Malware Delivery https://darkreading.com/cloud-security/email-bombing-external-teams-chats-repeatable-access-path

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.