Microsoft Teams impersonation scams and Microsoft 365 token replay hit 79 organizations

· Cybersecurity

Two related Microsoft-focused threat patterns drew researcher attention. In one, attackers are using Microsoft Teams' external chat creation feature to impersonate IT support and deliver malware or ransomware, a "recurring social engineering pattern" documented across hundreds of cases, according to The Hacker News. Separately, The Hacker News reported that researchers at Huntress disclosed a Microsoft 365 campaign using an adversary-in-the-middle relay to capture sign-in sessions and replay stolen tokens to break into email accounts. The activity was observed between July 14 and September and compromised 97 accounts at 79 organizations. Both cases underscore how trusted collaboration and identity infrastructure remain the primary path for attackers.

Why it matters：Identity and collaboration platforms concentrate trust, so token replay and Teams-based impersonation scale quickly across organizations and are hard to distinguish from legitimate activity.

Key points

  • 97 accounts at 79 organizations were compromised in the Microsoft 365 campaign
  • Huntress observed the activity between July 14 and September
  • Attackers abuse Teams' external chat creation feature to pose as IT support

Sources (original reporting)

More stories from this day