Intel Drop 15 | Fake 'IT Support' on Microsoft Teams

intel-drop · TLP:CLEAR · 27 Oct 2026 · Risk 16/25 (L4 × I4)

Companion hunt: Hunt Drop 6.

Attack chain

400+ incidents analysed
Teams chat, then vishing, then RMM
Payload in under 15 minutes

Risk

16/25 CRITICAL (likelihood 4 × impact 4).

Confidence

Assessment	Confidence
Activity	HIGH
Named group	LOW

Sources

Arctic Wolf: https://arcticwolf.com/resources/blog/threat-actors-abuse-microsoft-teams-external-chat-for-initial-access/