Hackers Abuse Microsoft Teams Default to Hijack Corporate PCs

The setup: inbox floods and a helpful fake desk

The attack begins with pure distraction. A worker suddenly receives hundreds or thousands of junk emails within minutes, burying their legitimate correspondence and creating instant frustration.

Moments later, a chat notification pings inside Microsoft Teams. A user profile showing a name like "IT Service Desk" or paired with a generic first name reaches out, stating they noticed the mailbox problem and can resolve it immediately. In several documented instances, the attacker bypassed text entirely and placed a direct voice call through Teams to make the intervention feel urgent and authentic.

Abusing Quick Assist to plant AnyDesk and ScreenConnect

Instead of attempting to trick victims into downloading suspicious executables from the web, the scammers rely entirely on software already present on the system. They ask the employee to launch Windows Quick Assist, a legitimate remote assistance utility bundled into modern Windows installations and signed by Microsoft.

Once the employee provides the required six-digit session code, the intruder gains interactive desktop access. From there, the attackers install commercial remote monitoring and management tools like AnyDesk or ConnectWise ScreenConnect. That secondary channel gives them persistent administrative reach even if the victim closes Quick Assist, allowing the group to map internal networks in preparation for deeper intrusions or ransomware deployment.

Why Microsoft Teams allows external messages out of the box

The entire social-engineering chain depends on a single configuration choice: Teams ships with external access—known as federation—enabled across all tenants by default.

Because Microsoft leaves external chat wide open, anyone holding an active Microsoft 365 tenant can message users in another organization unless an administrator has explicitly locked it down. This is not a zero-day exploit or software vulnerability; threat actors simply take advantage of an open collaboration feature that corporate IT teams routinely forget to restrict.

Unlike previous token-theft campaigns like the Android flaw that hijacked Microsoft tokens, this strategy requires no code exploitation at all. It relies entirely on human trust and default platform permissiveness.

What it means for enterprise IT admins

Organizations operating Microsoft 365 environments in North America and Europe should immediately evaluate their Teams external communication policies. In the Microsoft Teams admin center, navigate to Users > External access and restrict open federated chat.

Security teams should change the policy from the default "allow all external domains" to an approved allow-list of known corporate partners, or disable external tenant communication entirely if inter-company chat is not required.