Cybersecurity researchers have documented what they describe as a recurring social engineering pattern across hundreds of incidents, in which attackers abuse Microsoft Teams' external chat creation feature to impersonate internal IT staff and deliver malware or ransomware.
The campaign is notable less for its technical novelty than for its consistency. Investigators identified the same disposable tenants appearing repeatedly, alongside the same scripted "IT support" approach, across a large volume of cases — evidence of an industrialised operation rather than opportunistic, one-off attempts.
The attack hinges on functionality that is working exactly as designed. Teams permits external tenants to initiate chats with users inside an organisation, a feature intended to support cross-company collaboration. Attackers exploit that by registering or repurposing throwaway tenants, then messaging staff under a plausible support persona with a script that follows a familiar rhythm: an urgent IT-related prompt, a link or instruction, and a payload. Because the entry point is a legitimate, supported capability rather than a vulnerability, a software patch will not close the gap. The remedy lies in tenant policy configuration and staff awareness.
That structural reality shapes the defence, and it yields a five-point checklist for IT managers:
- Restrict the entry point. Administrators can block external chat and external meeting invitations at the tenant level through Microsoft 365 admin controls, limiting who is able to reach users in the first place.
- Detect on tenant identity, not display name. Signals worth watching include a newly observed external tenant messaging multiple staff members in quick succession, or a single sender presenting as IT support across unrelated departments.
- Exploit attacker infrastructure reuse. Because the same throwaway tenants and the same script recur, indicators can be catalogued and blocked at scale, and consistent countermeasures will have an outsized effect on a commoditised campaign.
- Verify out of band. Organisations should train front-line staff to treat any request that ends in a link, a download, a credential prompt, or a screen-share request as suspicious by default, and to check it against a known phone number, an internal directory entry, or an in-person confirmation — rather than replying in the same chat window. A blame-free protocol in which employees can rehearse refusing an unsolicited "IT" request reduces the chance that urgency or authority pressure will override caution.
- Block unmanaged remote-access tools. This denies attackers a path from foothold to control.
For Hong Kong IT managers, general incident-reporting routes remain available should a campaign land inside their environment: suspected phishing and compromised accounts can be reported to HKCERT, and organisations subject to the Personal Data (Privacy) Ordinance should assess whether an incident involving personal data triggers notification considerations under the PDPO. These are standing options, not a response directed at this particular campaign.
The broader takeaway for IT teams is that a feature behaving as intended can still be an attack surface. Closing it requires a deliberate configuration decision and a workforce that knows how to challenge an unexpected request from "the help desk."
網絡安全研究員記錄了數百宗個案，指出當中存在一種反覆出現的社交工程模式：攻擊者濫用 Microsoft Teams 的外部聊天建立功能，冒充機構內部 IT 人員，向受害人投放惡意軟件或勒索軟件。
此攻擊行動的特點，與其說在於技術上的新意，不如說在於其高度一致性。調查人員發現，同一批一次性租用戶（tenant）反覆出現，配合同一套照本宣科的「IT 支援」手法，遍及大量個案——證據顯示這是一場工業化運作的行動，而非 opportunistic 的零星嘗試。
攻擊所依賴的功能，本身完全按設計運作。Teams 允許外部租用戶向機構內的用戶發起聊天，此功能原本旨在支援跨公司協作。攻擊者藉此註冊或挪用一次性租用戶，然後以合理的支援人員身份向員工發送訊息，腳本遵循熟悉節奏：一個緊急的 IT 相關提示、一個連結或指示，以及一個惡意載荷（payload）。由於入口點是合法且受支援的功能，而非漏洞，單靠軟件修補程式並不能堵塞這個缺口。補救方法在於租用戶政策配置以及員工警覺性。
這種結構性的現實決定了防禦方向，並衍生出以下給 IT 管理人員的五點清單：
- 限制入口點。 系統管理員可透過 Microsoft 365 管理控制在租用戶層級封鎖外部聊天及外部會議邀請，從根本上限制誰能夠接觸機構用戶。
- 根據租用戶身份而非顯示名稱進行偵測。 值得留意的訊號包括：一個新近出現的外部租用戶短時間內接連訊息多名員工，或同一發送者在互不相關的部門之間均自稱 IT 支援。
- 利用攻擊者基礎設施重用的特性。 由於同一批一次性租用戶和同一套腳本反覆出現，相關指標可加以彙整並大規模封鎖，而一致的對策對這種已商品化的攻擊行動會產生格外顯著的效果。
- 透過額外渠道核實。 機構應培訓前線員工，凡任何最終涉及連結、下載、輸入憑證或要求共享螢幕的請求，一律預設視為可疑，並應以已知的電話號碼、內部通訊錄條目或當面確認等方式核對——而非直接在同一個聊天視窗回覆。一套不作事後追究的機制，讓員工可以演練拒絕不請自來的「IT」請求，可降低緊急情況或權威壓力凌駕審慎判斷的機會。
- 封鎖未經管理的遠端存取工具。 這可切斷攻擊者從立足點進一步控制系統的路徑。
對於香港的 IT 管理人員而言，萬一此類攻擊行動落入其環境之中，一般事故通報途徑仍然適用：懷疑遭遇釣魚攻擊及賬戶被入侵，可向 HKCERT 舉報；受《個人資料（私隱）條例》規管的機構，則應評估涉及個人資料的事故是否觸發 PDPO 下的通報考量。這些屬既有的標準選項，並非專門針對本次攻擊行動的應對措施。
對 IT 團隊而言，更廣泛的啟示是：一個運作如常的功能，仍然可以成為攻擊面（attack surface）。要堵塞它，需要有意識的配置決定，以及一支懂得質疑來自「help desk」的意外請求的員工隊伍。