Microsoft Teams Phishing Campaigns - Rapid7 Guidance Alert
Basically, hackers are pretending to be IT support on Teams to trick users into giving them access to their computers.
Rapid7 has identified a rise in phishing campaigns using Microsoft Teams. Threat actors impersonate IT departments to trick users into granting remote access. This poses a serious risk to organizational security.
What Happened
The Rapid7 Managed Detection and Response (MDR) team has identified a concerning trend in phishing campaigns. These campaigns involve threat actors impersonating internal IT departments through Microsoft Teams. Their goal is to convince users to launch Quick Assist, which grants them remote access to deploy malware and exfiltrate data. This tactic highlights a critical vulnerability in how organizations manage external access to collaboration tools.
In these campaigns, the threat actors send spoofed chat requests that appear to be from legitimate internal aliases like "IT Support" or "System Admin." Once users accept the chat request, they are engaged under the guise of offering technical support or performing security updates. This method of social engineering takes advantage of the inherent trust users place in collaboration platforms, making it easier for attackers to exploit them.
Who's Being Targeted
These phishing attempts are indiscriminate, targeting multiple users within an organization simultaneously. The impersonation of IT support is particularly effective because it plays on the users' trust and urgency. Many employees may not question the legitimacy of a message from someone they believe to be their IT department, especially if it appears to address an urgent issue.
This tactic is especially dangerous as it can lead to widespread access across an organization’s network. Once a threat actor gains access to a single machine, they can deploy malware, exfiltrate sensitive information, or move laterally to other systems within the network.
Signs of Infection
Organizations must be vigilant for specific signs of these phishing attempts. Users should be trained to recognize the following hallmarks of Teams spoofing:
- External tag: Legitimate internal IT support will never have an "external" tag next to their name.
- Sense of urgency: Attackers often create a false sense of urgency, claiming there is a security breach or an expired password.
- Out-of-band verification: Establish policies that require IT to never initiate support sessions without a pre-existing ticket number.
Recognizing these signs can help prevent successful phishing attempts and protect sensitive data from being compromised.
How to Protect Yourself
To mitigate the risks associated with these phishing campaigns, Rapid7 recommends several technical controls:
- Harden Microsoft Teams settings: Limit external communications to only approved domains. Disable the ability for users to communicate with external Teams users unless necessary.
- Implement automatic blocking of spoofed messages: Enable Spoof Intelligence within Microsoft 365 security settings to detect and block malicious senders.
- Disable or harden Quick Assist: If not needed, consider removing or disabling Quick Assist to prevent unauthorized remote access.
- Train staff: Regularly remind users to look for the external tag and to verify any unsolicited requests for support.
By taking these proactive measures, organizations can significantly reduce their vulnerability to these types of phishing attacks and protect their networks from unauthorized access.
Rapid7 Blog