Teams External Access Abused via 30-40% onmicrosoft.com Tenants in Recurring IT Support Scams

The pattern documented by Arctic Wolf shows consistent use of throwaway tenants, display names like Help Desk IT Support or Enterprise IT & Security (Internal), and *.onmicrosoft.com domains in nearly 30-40% of cases. Attackers avoid direct URL pasting to evade Safe Links scanning, instead navigating to payloads during live remote sessions via Quick Assist, AnyDesk, or ScreenConnect. This sequence follows mail bombing to create urgency and targets organizations with external Teams access enabled. Evidence from Sophos ties the activity to STAC4749, which favors .top TLDs for paid domains in roughly 50% of recent operations, alongside usernames mimicking employees. The shift from free onmicrosoft.com fallbacks to these paid domains indicates adaptation after tenant blacklisting. Remote access enables reconnaissance, lateral movement to domain controllers, Level RMM redundancy, data exfiltration, and final ransomware deployment. This approach exploits Microsoft’s external user warnings and identity provisioning gaps rather than zero-days. It aligns with broader patterns where social engineering chains cloud collaboration tools to trusted RMM software, bypassing endpoint controls focused on email. Organizations enabling guest access without strict tenant verification or conditional access policies create persistent entry points. Defenders should prioritize monitoring for anomalous external Teams sessions paired with mail bombing spikes and unusual RMM installations. Contract reviews of Microsoft 365 tenant policies and procurement of Teams logging enhancements will be required to close the external chat vector before it scales further.