Cross-tenant risk grows: The attack chain uses Teams’ cross-tenant communication capability, which allows external users to initiate chats with employees, Microsoft wrote in the blog.”The cross-tenant risk is significant, and many organizations probably do underestimate it,” said Sunil Varkey, advisor at Beagle Security.”Collaboration tools were designed to reduce friction, but many organizations enabled that convenience before fully applying Zero Trust controls,” Varkey said. “The sustainable approach is to keep the business value of these platforms while treating every external interaction, support request, and access approval as something that must be verified, limited, and monitored.”He compared the risk to a physical security gap. Allowing anyone into a lobby should not mean they can walk employees to restricted areas and request access.Kaur added that many enterprises still treat collaboration platforms primarily as productivity tools rather than part of their attack surface. “Cross-tenant access is necessary for business, but it introduces a trust boundary that is often not well understood or tightly controlled,” she said.Gogia said the issue is rooted in how trust is applied in modern environments. “External actors can now initiate interactions inside environments that employees associate with internal coordination,” he said, adding that this creates a “false sense of safety.”
Detection becomes harder: Microsoft said attackers use legitimate administrative tools and remote access utilities after gaining entry, making activity harder to distinguish from normal operations.Because attackers use legitimate tools and approved workflows, “there’s very little that looks overtly malicious in isolation,” Kaur said. “These attacks blend into normal IT operations.”Microsoft also noted that attackers rely on native administrative tools and legitimate data transfer utilities to move laterally and exfiltrate data while appearing as routine activity.This shifts the focus toward behavioral detection. “Security teams should prioritize detecting sequences of activity,” Kaur said, pointing to patterns such as an unsolicited external Teams interaction followed by remote support activity and lateral movement.Gogia said this requires a shift in detection approach. “These attacks do not rely on exploits. They rely on sequence,” he said. “Each individual action appears legitimate. The compromise emerges only when those actions are connected.”Varkey added that defenders need to move beyond traditional indicators. “Because these attacks rely on legitimate tools and user-approved actions, security teams need to focus on context and behavior, not just malware,” he said.
Tighter controls needed: To reduce risk, experts say organizations need stronger governance over collaboration environments.”Collaboration platforms are often configured for convenience first, with easy external chat, calls, screen sharing, and remote assistance, without fully considering how those features can be abused together,” Varkey said.Kaur emphasized the need for integrated visibility. “The most effective defenses will come from integrating collaboration, identity, endpoint, and SOC visibility rather than treating them as separate layers,” she said.Recommended measures include tightening external access controls, restricting remote-support tools to approved workflows, enforcing conditional access and multi-factor authentication, and improving user awareness around how legitimate IT support interactions occur, Microsoft wrote.
First seen on csoonline.com
Jump to article: www.csoonline.com/article/4160858/attackers-abuse-microsoft-teams-to-impersonate-the-it-helpdesk-in-a-new-enterprise-intrusion-playbook.html
