Microsoft Teams External Chat Exploited for Network Access
Threat actors are using default chat settings to impersonate IT support and gain remote control of corporate machines.
Updated on Oct. 27, 2026 in Cybersecurity
Live Poll
Do you trust that common communication apps you use for work provide sufficient security against scams?
Security firm Arctic Wolf has identified over 400 incidents where threat actors exploit Microsoft Teams external chat features to gain unauthorized corporate network access. Attackers leverage default platform settings to impersonate IT support and deploy remote management tools.
Why it matters
The exploitation of Teams external access settings underscores the risks of default-on communication configurations in enterprise environments. By turning common workflow features into entry points, attackers can facilitate lateral movement using native Windows tools.
Arctic Wolf reports that attackers achieve payload execution within 15 minutes of initial contact. The methodology relies on creating legitimate Microsoft 365 tenants to establish credible external identities.
The players
Arctic Wolf
A cybersecurity firm specializing in security operations and incident response.
Microsoft
The technology corporation that develops the Microsoft 365 suite and the Teams communication platform.
The details
Attackers initiate the campaign by flooding a target's inbox with automated email alerts, creating a manufactured technical crisis. The threat actor then impersonates IT support via Microsoft Teams, using the platform's external chat feature, which is enabled by default. Once the victim accepts the interaction, the attacker uses remote monitoring and management tools—software designed for IT administrative tasks like Quick Assist, AnyDesk, or ScreenConnect—to gain control of the machine. The sequence concludes with the execution of PowerShell payloads to move laterally through the internal network.
Timeline
October 26, 2026: Arctic Wolf published research findings on Teams exploitation.
The Tech Race
This exploitation technique highlights a persistent gap in enterprise security regarding the misuse of native administrative tools. It demonstrates how attackers are increasingly focusing on the legitimate features of Microsoft 365 to bypass traditional perimeter defenses.
Corporate IT administrators should review external access policies in Microsoft Teams to determine if the default-on state aligns with their security posture. Organizations using Windows may also need to audit the usage of remote management tools to prevent unauthorized administrative control.
The takeaway
The effectiveness of these attacks relies heavily on the availability of Teams external access by default. Security teams should monitor for unauthorized Microsoft 365 tenants and unexpected activity involving remote access software to mitigate this risk.
Further reading
For broader trends in corporate platform security, explore our Cybersecurity section.
Live Poll
Do you trust that common communication apps you use for work provide sufficient security against scams?
