Security researchers are warning about a recurring attack pattern in which threat actors use Microsoft Teams external chat to impersonate IT support staff and persuade employees to take actions that can lead to malware infections or ransomware incidents. The reported activity appears to rely on social engineering and the misuse of Teams features, rather than a newly disclosed software vulnerability.

What happened

According to the report, attackers have used Microsoft Teams' external chat creation capability across hundreds of cases to contact employees from outside an organisation. In these incidents, the attackers allegedly impersonated IT support and used consistent tactics, including throwaway Microsoft 365 tenants, to make their messages appear operationally credible.

The objective of these campaigns is to gain user trust quickly inside a business communication channel that many employees already use every day. Once that trust is established, the attacker may attempt to persuade the target to open a file, follow instructions, approve access, or take another step that can enable malware delivery or broader compromise. Researchers say some incidents have been linked to ransomware deployment.

Why it matters for European businesses

For European companies, the issue is significant because Microsoft Teams is deeply embedded in daily operations across SMEs, larger enterprises, agencies and distributed teams. Employees are often trained to treat email as risky, but internal collaboration platforms can feel more trustworthy, especially when a message appears to come from someone claiming to be from IT.

This makes Teams-based impersonation a business risk with practical consequences:

• Higher likelihood of user trust: Messages arriving in a familiar work tool may receive less scrutiny than email.
• Potential malware and ransomware impact: A successful interaction can lead to endpoint compromise, operational disruption, data loss and recovery costs.
• Identity and tenant exposure: Attackers can use external collaboration features to reach staff directly without relying only on traditional phishing channels.
• Compliance and reporting implications: If an attack leads to personal data exposure or service disruption, businesses may face GDPR, contractual or sector-specific incident handling obligations.

The broader lesson is that collaboration tools should be treated as part of the attack surface. Security controls and awareness programmes that focus only on email may leave a gap.

Who may be affected

The risk is relevant to organisations that use Microsoft 365 and allow Teams communication with external users. It may be especially important for:

• SMEs with limited in-house security resources
• Businesses with remote or hybrid workforces that depend heavily on chat-based support
• IT helpdesks and managed service environments where staff routinely receive support requests and access prompts
• E-commerce and digital businesses where downtime from ransomware can quickly affect revenue
• Regulated organisations that must document incidents and protect sensitive customer or operational data

What companies should consider

Businesses do not need to assume Teams is unsafe, but they should review how external messaging is governed and how staff verify support requests.

• Review Teams external access and chat settings: Confirm whether external chat is necessary for all users and whether restrictions can be applied.
• Define a verification process for IT support: Employees should know how legitimate IT support contacts them and how to verify unusual requests.
• Update security awareness training: Include Teams, Slack and other collaboration tools in phishing and impersonation training, not just email.
• Harden endpoint and identity controls: Use least-privilege access, multifactor authentication, endpoint protection and monitoring to reduce the impact of a successful social engineering attempt.
• Prepare ransomware response procedures: Ensure backups, isolation procedures, incident contacts and recovery plans are current.
• Monitor for unusual external contact patterns: Security and IT teams should watch for suspicious messages from newly created or unknown tenants, especially those claiming to be support personnel.

For European businesses, this is a practical reminder that modern phishing and impersonation now happen across workplace collaboration platforms as well as email. Companies that rely on Microsoft Teams should assess whether current policies, user training and monitoring reflect that reality.