Loading story…
Threat actors are abusing legitimate Microsoft Teams functionality—specifically the “Invite a Guest” workflow—to deliver billing-themed phishing lures via authentic Microsoft-generated email notifications. Attackers create Teams with deceptive names that resemble urgent financial alerts (e.g., subscription renewal/auto-pay notices) and then invite external users as guests; the resulting email originates from legitimate Microsoft infrastructure (e.g., noreply@email.teams.microsoft.com), allowing it to pass SPF/DKIM/DMARC and bypass many traditional email security controls. To evade content filtering, the lures use obfuscation (e.g., substituting 0 for O) and embed the fraudulent message directly in the Team name so it appears prominently in the notification.
Unlike common credential-harvesting campaigns that rely on malicious links, the observed activity emphasizes phone-based social engineering (vishing) by placing a fake support number in the Team name and instructing recipients to call to dispute a charge. Reporting indicates the campaign is highly active (on the order of ~990 messages/day) and disproportionately targets organizations in manufacturing/engineering/construction, technology/SaaS, and education, with the majority of observed activity in the United States. Separately, CloudSEK reported Canada-focused fraud operations tied to the PayTool phishing ecosystem (SMS lures impersonating government agencies and national brands), which is a different set of scams and infrastructure than the Microsoft Teams invite abuse described above.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Check Point Research disclosed telemetry showing the campaign operating at scale, peaking at 12,866 messages, or about 990 per day, reaching roughly 6,135 customers. The United States accounted for most observed activity, with manufacturing/engineering/construction, technology/SaaS/IT, and education among the most affected sectors.
Threat actors began abusing Microsoft Teams' legitimate "Invite a Guest" and notification features to send fake billing or invoice notices that appeared to come from trusted Microsoft infrastructure. The lures embedded fraudulent support phone numbers in finance-themed team names and used obfuscation such as lookalike characters and mixed Unicode to evade detection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
arstechnica.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported several **social-engineering campaigns** that abuse trusted platforms to increase credibility and bypass controls. One campaign targeted wedding planners and related vendors by hijacking trust in *Microsoft Teams*: attackers used compromised legitimate email threads and impersonated legal professionals (e.g., `czimmerman@craigzlaw[.]com`) to lure victims into clicking a fake Teams meeting link that ultimately redirected to `ussh[.]life/connect/teamsfinal/9/windows`, a site masquerading as a Teams download page. Victims were prompted to download Windows executables consistent with **information-stealer** behavior (credential/browser/session-token theft and C2 exfiltration), enabling follow-on account takeover and additional phishing. Separately, a report highlighted **DKIM replay**-style phishing in which criminals abuse legitimate notification/invoice workflows from **PayPal, Apple, and DocuSign** to generate cryptographically signed emails that pass DKIM/DMARC checks; attackers place scam content (often a fake support phone number and urgency) into user-controlled fields, send the message to themselves to obtain a “clean” vendor-signed email, then forward it to targets. Another campaign used **Bing search ads** to funnel users through a newly registered domain (`highswit[.]space`) to scam pages hosted on **Microsoft Azure Blob Storage** (consistent path pattern including `werrx01USAHTML/index.html` and a phone-number parameter), presenting fake Microsoft security warnings and directing victims to call numbers such as `1-866-520-2041` and `1-833-445-4045`; Netskope observed impact across dozens of US organizations.
Jun 29, 2026
Microsoft reported detecting **7.6 billion** email-based phishing threats in Q2 2026, with credential theft driving **94% to 96%** of malicious payload activity. The company said its March disruption of the **Tycoon2FA** phishing-as-a-service platform cut message volume tied to that operation by **92%** from pre-disruption levels, while QR-code phishing and CAPTCHA-gated phishing also declined. A short-lived April rise in business email compromise was attributed to a small number of high-volume campaigns rather than a sustained surge. Attackers increasingly shifted to **Microsoft Teams** for social engineering, particularly vishing and fake IT-support interactions that abused remote-access tools such as **Quick Assist**; weekly malicious call attempts rose roughly **80%** since the start of 2026 and reached nearly **10 times** the mid-2025 baseline by late June. Microsoft also described a June automated BEC campaign that hit more than **67,000 users** across **42,000 organizations** in under three hours, along with a multi-stage phishing operation that used nested **EML** files, **ICS** invitations, Microsoft OAuth redirection, and a **BAT** dropper to deliver malware.
Aug 18, 2026
Attackers used **Microsoft Teams** to impersonate IT or helpdesk staff and socially engineer employees into granting access or executing malicious actions, turning collaboration tooling and trusted support workflows into the initial access vector. One report describes a compromise at an Italy-based consumer services company where a Teams meeting invite and screen sharing session led the victim to run a staged **PowerShell** chain that deployed **PhantomBackdoor**, a multi-stage **WebSocket-based** backdoor associated with earlier spear-phishing activity. The observed sequence included post-call PowerShell execution, device reconnaissance, and establishment of WebSocket command-and-control. A second report describes a similar **vishing** intrusion in which a threat actor posing as support staff called employees through Teams and, after multiple attempts, convinced one user to grant remote access through **Quick Assist**. The attacker then directed the victim to a spoofed credential-harvesting site, used a malicious **MSI** and sideloaded **DLL** to launch follow-on payloads, and established outbound C2. While the malware families and exact post-compromise chains differ, both accounts document the same operational pattern: **Teams-based social engineering**, abuse of legitimate remote assistance or user-guided execution, credential theft or payload staging, and transition to hands-on intrusion activity inside a corporate environment.
Jun 29, 2026