{"id":59474,"date":"2025-10-07T17:00:00","date_gmt":"2025-10-07T17:00:00","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=142923"},"modified":"2025-10-07T17:00:00","modified_gmt":"2025-10-07T17:00:00","slug":"disrupting-threats-targeting-microsoft-teams","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/disrupting-threats-targeting-microsoft-teams\/","title":{"rendered":"Disrupting threats targeting Microsoft Teams"},"content":{"rendered":"

The extensive collaboration features and global adoption of Microsoft Teams make it a high-value target for both cybercriminals and state-sponsored actors. Threat actors abuse its core capabilities \u2013 messaging (chat), calls and meetings, and video-based screen-sharing \u2013 at different points along the attack chain. This raises the stakes for defenders to proactively monitor, detect, and respond.<\/p>\n

While under Microsoft\u2019s Secure Future Initiative<\/a> (SFI), default security has been strengthened by design, defenders still need to make the most out of customer-facing security capabilities. Therefore, this blog recommends countermeasures and controls across identity, endpoints, data apps, and network layers to help harden enterprise Teams environments. To frame these defenses, we first examine relevant stages of the attack chain. This guidance complements, but doesn\u2019t repeat, the guidance built into the Microsoft Security Development Lifecycle (SDL)<\/a> as outlined in the Teams Security Guide<\/a>;  we will instead focus on guidance for disrupting adversarial objectives based on the relatively recently observed attempts to exploit Teams infrastructure and capabilities.<\/p>\n

Attack chain<\/h2>\n
\"Diagram
Figure 1. Attack techniques that abuse Teams along the attack chain<\/figcaption><\/figure>\n

Reconnaissance<\/h3>\n

Every Teams user account is backed by a Microsoft Entra ID identity<\/a>. Each team member is an Entra ID object<\/a>, and a team is a collection of channel objects. Teams may be configured for the cloud or a hybrid environment and supports multi-tenant organizations (MTO)<\/a> and cross-tenant<\/a> communication and collaboration. There are anonymous<\/a> participants, guests<\/a>, and external access<\/a> users. From an API perspective, Teams is an object type that can be queried and stored in a local database for reconnaissance by enumerating directory objects, and mapping relationships and privileges. For example, federation tenant configuration<\/a> indicates whether the tenant allows external communication and can be inferred from the API response queries reflecting the effective tenant federation policy.<\/p>\n

While not unique to Teams, there are open-source frameworks that can specifically be leveraged to enumerate less secure users, groups, and tenants in Teams (mostly by repurposing the Microsoft Graph API<\/a> or gathering DNS), including ROADtools, TeamFiltration, TeamsEnum<\/a>, and MSFT-Recon-RS<\/a>. These tools facilitate enumerating teams, members of teams and channels, tenant IDs and enabled domains, as well as permissiveness for communicating with external organizations and other properties, like presence. Presence<\/a> indicates a user\u2019s current availability and status outside the organization if Privacy mode is not enabled, which could then be exploited if the admin has not disabled<\/a> external meetings and chat with people and organizations outside the organization (or at least limited it to specified external domains).<\/p>\n

Many open-source tools are modular Python packages including reusable libraries and classes that can be directly imported or extended to support custom classes, meaning they are also interoperable with other custom open-source reconnaissance and discovery frameworks designed to identify potential misconfigurations.<\/p>\n

Resource development<\/h3>\n

Microsoft continuously enhances protections against fraudulent Microsoft Entra ID Workforce tenants and the abuse of free tenants and trial subscriptions. As these defenses grow stronger, threat actors are forced to invest significantly more resources in their attempts to impersonate trusted users, demonstrating the effectiveness of our layered security approach. . This includes threat actors trying to compromise weakly configured legitimate tenants, or even actually purchasing legitimate ones if they have confidence they could ultimately profit. It should come as no surprise that if they can build a persona for social engineering, they will take advantage of the same resources as legitimate organizations, including custom domains<\/a> and branding<\/a>, especially if it can lend credibility to impersonating internal help desk, admin, or IT support, which could then be used as a convincing pretext to compromise targets through chat messaging and phone calls. Sophisticated threat actors try to use the very same resources used by trustworthy organizations, such as acquiring multiple tenants for staging development or running separate operations across regions, and using everyday Teams features like scheduling private meetings through chat, and audio, video and screen-sharing capabilities for productivity.<\/p>\n

Initial access<\/h3>\n

Tech support scams remain a generally popular pretext for delivery of malicious remote monitoring and management<\/a> (RMM) tools and information-stealing malware, leading<\/a> to credential theft, extortion, and ransomware<\/a>. There are always new variants to bypass security awareness defenses, such as the rise in email bombing<\/a> to create a sense of stress and urgency to restore normalcy. In 2024, for instance, Storm-1811 impersonated tech support, claiming to be addressing junk email issues that it had initiated. They used RMM tools to deliver the ReedBed malware loader of ransomware payloads and remote command execution. Meanwhile, Midnight Blizard has successfully impersonated security and technical support teams to get targets to verify their identities under the pretext of protecting their accounts by entering authentication codes that complete the authentication flow for breaking into the accounts.<\/p>\n

Similarly in May, Sophos identified<\/a> a 3AM ransomware (believed to be a rebranding of BlackSuit<\/a>) affiliate adopting techniques from Storm-1811<\/a>, including flooding employees with unwanted emails followed by voice and video calls on Teams impersonating help desk personnel, claiming they needed remote access to stop the flood of junk emails. The threat actor reportedly spoofed the IT organization\u2019s phone number.<\/p>\n

With threat actors leveraging deepfakes<\/a>, perceived authority helps make this kind of social engineering even more effective. Threat actors seeking to spoof automated workflow notifications and interactions can naturally extend to spoofing legitimate bots and agents as they gain more traction, as threat actors are turning to language models to facilitate their objectives.<\/p>\n

Prevalent threat actors associated with ransomware campaigns, including the access broker tracked as Storm-1674 have used sophisticated red teaming tools, like TeamsPhisher<\/a>, to distribute DarkGate malware and other malicious payloads over Teams. In December 2024, for example, Trend Micro reported<\/a> an incident in which a threat actor impersonated a client during a Teams call to persuade a target to install AnyDesk. Remote access was reportedly then used also to deploy DarkGate. Threat actors may also just use Teams to gain initial access through drive-by-compromise activity to direct users to malicious websites.<\/p>\n

Widely available admin tools, including AADInternals<\/a>, could be leveraged to deliver malicious links and payloads directly into Teams. Teams branding (like any communications brand asset) makes for effective bait, and has been used by adversary-in-the-middle (AiTM) actors like Storm-00485<\/a>. Threat actors could place malicious advertisements in search results for a spoofed app like Teams to misdirect users to a download site hosting credential-stealing malware. In July 2025, for instance, Malwarebytes reported<\/a> observing a malvertising campaign delivering credential-stealing malware through a fake Microsoft Teams for Mac installer.<\/p>\n

Whether it is a core app that is part of Teams, an app created by Microsoft, a partner app validated by Microsoft, or a custom app created by your own organization\u2014no matter how secure an app\u2014they could still be spoofed to gain a foothold in a network. And similar to leveraging a trusted brand like Teams, threat actors will also continue to try and take advantage of trusted relationships as well to gain Teams access, whether leveraging an account with access or abusing delegated administrator relationships to reach a target environment.<\/p>\n

Persistence<\/h3>\n

Threat actors employ a variety of persistence techniques to maintain access to target systems\u2014even after defenders attempt to regain control. These methods include abusing shortcuts in the Startup folder to execute malicious tools, or exploiting accessibility features like Sticky Keys (as seen in this ransomware case study<\/a>). Threat actors could try to create guest users in target tenants or add their own credentials to a Teams account to maintain access.<\/p>\n

Part of the reason device code phishing has been used to access target accounts is that it could enable persistent access for as long as the tokens remain valid. In February, Microsoft reported<\/a> that Storm-2372 had been capturing authentication tokens by exploiting device code authentication flows, partially by masquerading as Microsoft Teams meeting invitations and initiating Teams chats to build rapport, so that when the targets were prompted to authenticate, they would use Storm-2372-generated device codes, enabling Storm-2372 to steal the authenticated sessions from the valid access tokens.<\/p>\n

Teams phishing lures themselves can sometimes be a disguised attempt to help threat actors maintain persistence. For example, in July 2025, the financially motivated Storm-0324 most likely relied on TeamsPhisher to send Teams phishing lures to deliver a custom malware JSSloader for the ransomware operator Sangria Tempest to use as an access vector to maintain a foothold.<\/p>\n

Execution<\/h3>\n

Apart from admin accounts, which are an attractive target because they come with elevated privileges, threat actors try and trick everyday Teams users into clicking links or opening files that lead to malicious code execution, just like through email.<\/p>\n

Privilege escalation<\/h3>\n

If threat actors successfully compromise accounts or register actor-controlled devices, they often times  try to change permission groups to escalate privileges. <\/strong>If a threat actor successfully compromises a Teams admin role, this could lead to abuse of the permissions to use the admin tools that belong to that role.<\/p>\n

Credential access<\/h3>\n

With a valid refresh token, actors can impersonate users through Teams APIs. There is no shortage of administrator tools that can be maliciously repurposed, such as AADInternals, to intercept access to tokens with custom phishing flows. Tools like TeamFiltration could be leveraged just like for any other Microsoft 365 service for targeting Teams. If credentials are compromised through password spraying, threat actors use tools like this to request OAuth tokens for Teams and other services. Threat actors continue to try and bypass multifactor authentication (MFA) by repeatedly generating authentication prompts until someone accepts by mistake, and try to compromise MFA by adding alternate phone numbers or intercepting SMS-based codes.<\/p>\n

For instance, the financially motivated threat actor Octo Tempest<\/a> uses aggressive social engineering, including over Teams, to take control of MFA for privileged accounts. They consistently socially engineer help desk personnel, targeting federated identity providers using tools like AADInternals to federate existing domains, or spoof legitimate domains by adding and then federating new domains to forge tokens.<\/p>\n

Discovery<\/h3>\n

To refine targeting, threat actors analyze Teams configuration data from API responses, enumerate Teams apps if they obtain unauthorized access, and search for valuable files and directories by leveraging toolkits for contextualizing potential attack paths. For instance, Void Blizzard<\/a> has used AzureHound to enumerate a compromised organization\u2019s Microsoft Entra ID configuration and gather details on users, roles, groups, applications, and devices. In a small number of compromises, the threat actor accessed Teams conversations and messages through the web client. AADInternals can also be used to discover Teams group structures and permissions.<\/p>\n

The state-sponsored actor Peach Sandstorm has delivered malicious ZIP files<\/a> through Teams, then used AD Explorer<\/a> to take snapshots of on-premises Active Directory database and related files.<\/p>\n

Lateral movement<\/h3>\n

A threat actor that manages to obtain Teams admin access (whether directly or indirectly by purchasing an admin account through a rogue online marketplace) could potentially leverage external communication settings and enable trust relationships between organizations to move laterally. In late 2024, in a campaign dubbed VEILdrive<\/a> <\/em>by Hunters\u2019 Team AXON, the financially motivated cybercriminal threat actors Sangria Tempest and Storm-1674 used previously compromised accounts to impersonate IT personnel and convince a user in another organization through Teams to accept a chat request and grant access through a remote connection.<\/p>\n

Collection<\/h3>\n

Threat actors often target Teams to try and collect information from it that could help them to accomplish their objectives, such as to discover collaboration channels or high-privileged accounts. They could try to mine Teams for any information perceived as useful in furtherance of their objectives, including pivoting from a compromised account to data accessible to that user from OneDrive or SharePoint. AADInternals can be used to collect sensitive chat data and user profiles. Post-compromise, GraphRunner<\/a> can leverage the Microsoft Graph API to search all chats and channels and export Teams conversations.<\/p>\n

Command and control<\/h3>\n

Threat actors attempt to deliver malware through file attachments in Teams chats or channels. A cracked version of Brute Ratel C4 (BRc4) includes features to establish C2 channels with platforms like Microsoft Teams by using their communications protocols to send and receive commands and data.<\/p>\n

Post-compromise, threat actors can use red teaming tool ConvoC2<\/a> to send commands through Microsoft Teams messages using the Adaptive Card<\/a> framework to embed data in hidden span tags and then exfiltrate using webhooks. But threat actors can also use legitimate remote access tools to try and establish interactive C2 through Teams.<\/p>\n

Exfiltration<\/h3>\n

Threat actors may use Teams messages or shared links to direct data exfiltration to cloud storage under their control. Tools like TeamFiltration include an exfiltration module that rely on a valid access token to then extract recent contacts and download chats and files through OneDrive or SharePoint.<\/p>\n

Impact<\/h3>\n

Threat actors try to use Teams messages to support financial theft through extortion, social engineering, or technical means.<\/p>\n

Octo Tempest has used communication apps, including Teams to send taunting and threatening messages to organizations, defenders, and incident response teams as part of extortion and ransomware payment pressure tactics. After gaining control of MFA through social engineering password resets, they sign in to Teams to identify sensitive information supporting their financially motivated operations.<\/p>\n

Mitigation and protection guidance<\/h2>\n

Strengthen identity protection<\/h3>\n

Harden endpoint security<\/h3>\n