What is Microsoft Teams Phishing?

Introduction

The way we communicate with people always changes. While phone calls and emails are the main methods that organizations use, we also have made use of messaging apps. These apps are quickly becoming a primary way to communicate not only with coworkers, but with customers and loved ones as well. One of the main apps that organizations are using is Microsoft Teams.

However, as with most things that are connected to our devices, social engineering is sure to follow. Microsoft Teams phishing is becoming more and more of a problem when it comes to these connectivity apps. Because it is so easy to get access to it and contact others, it is a big tool for bad actors who want to steal your information and access.

What is Microsoft Teams?

Over the years, there have been many different meeting apps available for free. Many have disappeared from the public eye, but most businesses have ended up using Microsoft Teams for their instant messaging needs. Since it is integrated into Microsoft 365, it is an easy tool to use for communication between coworkers and managers, usually connected to the organization’s employee database.

While Microsoft Teams comes with payment plans for businesses, there is also a free edition for personal use. As long as you have someone’s email, it is likely that you will be able to communicate with them through Teams if they accept the contact. While this can be easy and useful for both employees and customers, bad actors will be able to send requests and messages as well.

What is phishing?

Social engineering has been a tool for bad actors for decades. One of the most popular methods of social engineering is phishing. Phishing is usually done with someone impersonating another person, be it an organization, a coworker, a contractor, or even a loved one. With this impersonation, the bad actor will attempt to obtain sensitive information or gain access to an account.

Historically, this has been over an email. However, with businesses prioritizing messenger apps like Microsoft Teams, instant messaging has also become a method of phishing. A bad actor will attempt to contact someone from an organization, posing as someone else, in order to steal something or have the target download something malicious.

How do bad actors use Microsoft Teams?

Like most social engineering attacks, they will come after a time of reconnaissance, which is the method of gathering information on a business or its employees that is readily available. This can include public information or information that is on the company’s website. The bad actors may also try to get customer information to pose as them as well. They also have tools that can skim email signatures and various other things to get more accurate information.

After that, there will be some work with Microsoft 365 in order to appear legitimate. The next steps are as follows:

• In M365, they will create a new tenant on the platform to appear as a trusted organization.
• With the obtained information, usually an email, they will sign up the email to many different services like newsletters and email notifications. To make things appear more legitimate, they bring down the amount of emails to a lower number as opposed to a normal phishing attempt.
• After the flood of spam, they will contact a member of the target organization for “assistance” with the spam problem.
• If the employee accepts this, they will attempt to bridge a connection through a remote access session. This can be done with things like Teamviewer and AnyDesk.
• With this access, the bad actor will attempt to install malicious things like malware or change security settings to allow further access.

As with most of these types of phishing attempts, there are usually policies that block things like external messages to get through. If not configured correctly, an organization can easily be hacked or breached with this type of phishing.

How to Stop Microsoft Teams Phishing

With default settings, a Microsoft 365 environment can be extremely vulnerable to outside attacks. Fortunately, there are plenty of ways to circumvent this sort of thing with a good cybersecurity posture. With the usual defenses, a bad actor won’t even be able to contact an employee through Microsoft Teams.

Security Awareness Training

With Microsoft Teams becoming a more central tool for communication in many businesses, it should be folded into their security awareness training. More and more third-party cybersecurity firms are including Microsoft Teams phishing simulations with their other simulated social engineering attacks.

Using the environment that exists, a third-party firm will use real-world tactics that are being used by real bad actors. They will attempt to appear legitimate and send messages requesting to be assisted or to click a malicious link, impersonating an employee or a customer. It will likely come from an outside source if the Microsoft 365 environment is set up correctly, but even then, the messages can sometimes get through if they have company emails.

Microsoft 365 Configuration Reviews

Often overlooked by many businesses, the Microsoft 365 environment can lead to many vulnerabilities if left to default settings. However, even with a bit of focus to it, it has constant updates that needs to be taken into consideration. Default Microsoft 365 settings means that outside messages can be sent to people inside of the organization, even though they’re labeled as external.

With a M365 configuration review, a security analyst or representative will go through your entire Microsoft 365 environment to make sure there are no gaps in the security, including internal and external connections and verifications. It is becoming an increasingly important service to get and can close any vulnerabilities that may come from it.

Conclusion

There are plenty of things to be aware of when it comes to social engineering. Bad actors are growing their targets to include Microsoft Teams phishing. They will send messages to people inside of the organization in hopes to get access to the systems in some way. This includes screensharing programs and malicious links.

With security awareness training and Microsoft 365 configuration reviews, an organization can improve their cybersecurity posture. With simulated Microsoft Teams phishing attacks, a company and its employees can know what to look for when it comes to these messages. With M365 becoming a larger encompassing environment, it’s always important to remember to be vigilant against these outside messages.