Threat reportPhishingTL-2026-4522
Fake IT Support via Microsoft Teams External Federation Leads to Remote Access and Malware (Chaos / Black Basta-linked)
Fake IT Support via Microsoft Teams External Federation (TL-2026-4522), also tracked as Teams vishing, is a high-severity phishing campaign, first published 2026-10-27. It is attributed to STAC4749 with medium confidence, affects Microsoft Microsoft Teams (external access/federation), maps to 26 MITRE ATT&CK techniques (T1021.001, T1027, T1036), and is covered by 9 detection rules and 59 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 26MITRE ATT&CK
- Actors
- 2STAC4749
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 59Indicators of compromise
Key facts for TL-2026-4522
- Threat ID
- TL-2026-4522
- Also known as
- Teams vishing, Fake IT support via Teams
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution
- STAC4749, Storm-1811
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- services, manufacturing, energy, construction, engineering, legal
- Target regions
- North America, canada, united states of america
- Detection rules
- 9
- Indicators of compromise
- 59
- Updates
- 2026-10-27 · 2 updates · revalidated 2× · latest source
Malware and tooling in Fake IT Support via Microsoft Teams External Federation
Malware and tooling: AnyDesk, Black Basta - S1070, Chaos, Chaos ransomware, NetSupportManager RAT, TeamViewer, Atera, Quick Assist, ScreenConnect, Zoho Assist
How Fake IT Support via Microsoft Teams External Federation works
Attackers abuse default-enabled Microsoft Teams external chat federation to impersonate IT help desk staff, typically after email bombing, and talk victims into granting remote access via Quick Assist or other RMM tools. Arctic Wolf analyzed 400+ incidents; related clusters include Storm-1811/Black Basta and STAC4749, which deployed Chaos ransomware in under 17 hours in one case.
Arctic Wolf Labs analyzed more than 400 incidents in which threat actors used Microsoft Teams external chat (federation, permitted by default in many tenants) to contact employees while posing as IT or help desk staff. The activity usually begins with email bombing: hundreds of newsletter and subscription confirmations arrive within minutes (Sophos observed 3,000 messages in 45 minutes in an earlier cluster), creating urgency and burying security alerts. The attacker then sends a Teams chat or call from an external tenant whose display name is made to look internal, for example with an '(Internal)' suffix or names such as 'Help Desk', 'IT Support' and 'Enterprise IT & Security (Internal)'. About 30-40% of attacker tenants used default *.onmicrosoft.com domains. Among paid domains roughly 50% were .top, about 40% .com and about 5% multi-level domains such as .com.pl, .com.vn and .com.br. Arctic Wolf also saw roughly 100 distinct emoji markers in attacker display names, and under 15 minutes from victim engagement to payload execution in reported chains.
Once the victim is engaged, the actor asks them to start a remote session. Quick Assist is the most frequently abused tool. AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport, LogMeIn and Level were also observed. A PowerShell command then downloads an MSI from Azure Blob Storage. In a novel chain documented by Arctic Wolf, the MSI contains cleaner.ps1 (dropped under AppData\Local\PowershellCleaner\scripts) and archive6.zip. The script holds a hexadecimal array with an IEX instruction and an AES-encrypted block with hardcoded key and IV, validates a hash, and runs via ScriptBlock. It extracts a pythonw interpreter from archive6.zip and, after a 5-second sleep, runs the Python implant ss.py. The implant performs LDAP enumeration of Active Directory computer and user objects with System.DirectoryServices.DirectorySearcher, formats results as [sAMAccountName] - [description], and sends them to randomly selected C2 endpoints from a hardcoded domain/URI list.
Sophos tracked a related cluster, STAC4749, between February and June 2026. It targeted mainly North American organizations (about 50% Canada, 44% USA) via Teams vishing from IT-themed .top domains and personas, abusing Quick Assist, RemSupp, DWAgent and AnyDesk. Operators deployed a PyArmor-obfuscated PyInstaller backdoor, Golang implants, a reverse SOCKS tunneling tool (sc5.exe) and persistence registry entries masquerading as Realtek audio services, enabled RDP for lateral movement, and in several incidents deployed Chaos ransomware. In one incident, less than 17 hours passed between first Teams contact and ransomware deployment. Sophos assesses with high confidence that STAC4749 is financially motivated; the Sophos report notes suspected ties to former BlackSuit/Royal members. Earlier clusters (STAC5143, STAC5777) used the same Teams impersonation pattern and were tied to Black Basta deployment, with Sophos assessing with medium confidence that the Python malware in one attack connects to FIN7. Arctic Wolf also lists Storm-1811/Black Basta, Cactus, 3AM, GoGRPC and UNC6692 as related campaigns. The GBHackers article itself names no single actor, so attribution here is to multiple overlapping clusters with MEDIUM confidence.
MITRE ATT&CK techniques used in TL-2026-4522
Lateral Movement
T1021.001 Remote Desktop Protocol
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1656 Impersonation; T1684.001 Impersonation
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053.005 Scheduled Task/Job; T1547.001 Registry Run Keys / Startup Folder
Execution
T1059.001 PowerShell; T1059.006 Python; T1204.002 Malicious File
Discovery
Command and Control
T1090 Proxy; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1219.002 Remote Access Tools: Remote Desktop Software; T1572 Protocol Tunneling
Initial Access
T1199 Trusted Relationship; T1566.003 Spearphishing via Service; T1566.004 Spearphishing Voice
Impact
T1486 Data Encrypted for Impact; T1667 Email Bombing
Resource Development
T1583.001 Domains; T1585.002 Email Accounts; T1585.003 Cloud Accounts
Affected products and versions in Fake IT Support via Microsoft Teams External Federation
Remediation for Fake IT Support via Microsoft Teams External Federation
Immediate actions
- Move Teams external access from 'allow all' to an allow-list of trusted organizations and block chat with unmanaged/consumer accounts
- Block federation with trial-only tenants: Set-CsTenantFederationConfiguration -ExternalAccessWithTrialTenants "Blocked"
- Block the attacker tenant/domains listed in the IOCs via the Microsoft Defender Tenant Allow/Block List
- Alert on external Teams ChatCreated events correlated with a mailbox email-bombing spike
Workarounds
- Disable Microsoft Quick Assist on critical systems
- Block external domains from initiating Teams messages and calls where business needs allow
Longer-term hardening
- Restrict Quick Assist and other RMM tools to authorized IT roles via application control or Defender for Endpoint
- Establish out-of-band verification (callback to a registered number) for any remote-access request
- Train users to recognize the External tag and '(Internal)' display-name spoofing
- Audit registry Run keys and services for masqueraded Realtek audio entries
Timeline of Fake IT Support via Microsoft Teams External Federation
- Arctic Wolf begins tracking Black Basta affiliates abusing Quick Assist via vishing after email bombing (month-level date: April 2024).
- Microsoft Teams observed as an additional contact vector alongside vishing (late May 2024; month-level date).
- Arctic Wolf publishes its bulletin on Black Basta affiliates using email bombing, vishing, Teams and Quick Assist for initial access.
- Security Affairs reports ReliaQuest research linking email flooding plus Teams impersonation to Black Basta (about 1,000 emails in 50 minutes; onmicrosoft.com fake help-desk tenants).
- Sophos observes Black Basta-linked actors using email bombing followed by Teams help-desk impersonation (reported as 'late 2024').
- Sophos publishes research on STAC5143 and STAC5777 email bombing and Teams impersonation clusters tied to Black Basta.
- Chaos ransomware-as-a-service becomes active, per Sophos (February 2025).
- STAC4749 Teams vishing activity against North American organizations begins (Sophos observation window February-June 2026).
- STAC4749 initial payloads named sekv_<10-digit>.exe observed (March 13-18).
- STAC4749 switches to helper_<10-digit>.exe payloads (March 26 - April 9).
- STAC4749 switches to 74fs_<10-digit>.exe payloads (April 10-13); RemSupp becomes the preferred remote tool after April.
- Arctic Wolf observes intrusion at a U.S. food and beverage organization: Teams helpdesk pretext, Quick Assist, SharePoint-hosted PowerShell loader, Rust reverse SOCKS proxy (accc.exe).
- End of the Sophos STAC4749 observation window (June 2026); Chaos ransomware deployed in several incidents.
- Sophos publishes the STAC4749 IOC list (STAC4749-Chaos_IOCs_July2026.csv).
- Arctic Wolf observes intrusion at an international manufacturer: systemcheck.zip fake security update and Xray-core deployed as ChromeUpdate.exe.
- Arctic Wolf Labs publishes its analysis of 400+ Teams external-chat abuse incidents, including the cleaner.ps1 / ss.py payload chain and tenant/domain infrastructure.
- GBHackers reports Arctic Wolf analysis of 400+ Teams external-chat impersonation incidents.
Update history for TL-2026-4522
- 2026-10-27 — Email Bombing and External Microsoft Teams Chats Form Repeatable IT-Impersonation Remote Access Path (400+ Incidents): What changed No field escalation: severity HIGH, exploitability ACTIVE and status ACTIVE already match the newer report. Update is additive intelligence only. New indicators (17) 10 new onmicrosoft.com/.top attacker tenants and domains, 1 d
- 2026-10-27 — Email Bombing plus Microsoft Teams External-Chat Impersonation of IT Help Desk for Initial Access (Black Basta, Cactus, 3AM, Chaos): What changed No severity, exploitability or status change (already HIGH / ACTIVE). Enrichment only. New indicators (14) 8 additional network indicators from the Arctic Wolf and ReliaQuest data: five onmicrosoft.com tenants, expertassist.top
Sources cited for Fake IT Support via Microsoft Teams External Federation
- Fake Microsoft Teams IT Support Messages Lead to Remote Access and Malware Infections (GBHackers)
- Threat Actors Abuse Microsoft Teams External Chat for Initial Access (Arctic Wolf)
- Chaos in Teams: STAC4749 vishing (Sophos)
- Ransomware gangs pose as IT support in Microsoft Teams phishing attacks (BleepingComputer)
- Microsoft Teams vishing attacks lead to Chaos ransomware attacks (BleepingComputer)
- Hackers use Microsoft Teams for ransomware IT support scams (Cybersecurity Dive)
- Ransomware groups pose as fake tech support over Teams (CyberScoop)
- Free Tenants, Fake Help Desks (Black Hills InfoSec ActiveSOC)
- Email bombing and fake IT support calls fuel Microsoft Teams phishing attacks (VPNCentral)
- STAC4749 Uses Microsoft Teams Vishing to Deploy Chaos Ransomware in North America (Ampcus Cyber)
Detection coverage for TL-2026-4522
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4522 across Splunk SPL, Microsoft KQL and Sigma, covering 59 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4522
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.