Social Engineering Campaign Targets Microsoft Teams Users

Researchers at CyberProof warn that threat actors are launching phishing attacks via Microsoft Teams' “Chat with Anyone” feature, which lets external users send direct messages via email addresses.

“Microsoft Teams now allows users to send direct chat invitations to any email address, even if recipients aren’t part of a Teams tenant,” the researchers explain. “Users can start chats with external participants who join as guests governed by Entra B2B Guest policies.”

In this case, an attacker sent direct messages to Teams users, posing as IT support. Several employees received these messages and were tricked into joining remote support sessions using Windows Quick Assist.

“The attacker then contacted the user as IT Support on the very next day (Nov 5, 2025), started a Teams call, and tricked the user into initiating Quick Assist by sending a phishing URL...where the user needed to provide login credentials to download Quick Assist,” CyberProof says. After the user entered their Microsoft credentials, the attacker installed an infostealer on their computer.

The researchers warn that organizations should prepare for more of these attacks as the “Chat with Anyone” feature is fully released in the coming weeks. Users should be wary of unsolicited messages, even if they appear to come from known colleagues.

“Since its rollout, the MS Teams feature, scheduled for early release in November 2025 and the full global rollout planned by January 2026, has raised concern about data exposure and compliance risks,” the researchers write. “We believe this could leave the door open for a potential escalation in more malware and phishing attacks.”

AI-powered security awareness training can give your organization an essential layer of defense against phishing and other social engineering attacks. KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 HRM+ platform to strengthen their security culture and reduce human risk.

CyberProof has the story.