Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malware.

"A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same 'IT Support (Internal)' display names, the same remote-access tools, and increasingly, the same payload domains," Arctic Wolf Labs said in a report shared with The Hacker News.

The attacks consistently employ IT-themed display names or friendly-sounding first names to subvert external-user warnings in Teams. These messages originate from Teams identities established through newly created or acquired Microsoft 365 tenants.

Nearly 30–40% of the cases investigated by the cybersecurity company involve the use of *.onmicrosoft[.]com, a permanent fallback domain automatically generated by Microsoft when a Microsoft 365 tenant is created. These domains masquerade as IT infrastructure, opting for a help desk- or support-themed word as the tenant name to increase their credibility -

As observed in many cases before, these Teams sessions are preceded by mail bombing, where the victim's inbox is flooded with hundreds of newsletter or subscription confirmations in a short span of time. The approach is designed to induce a false sense of urgency, with the Teams IT support message arriving soon after to help resolve the problem.

Some of the display names observed by Arctic Wolf across different cases are listed below -

In recent iterations, the attackers have been observed adding the target organization's domain or company name in their display name to lend the messages additional legitimacy.

Source link