OTX Threat: Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access

Adversaries are exploiting Microsoft Teams' default external chat functionality to conduct social engineering attacks and deliver malicious payloads. Analysis of over 400 incidents reveals threat actors consistently impersonate IT support personnel using throwaway Microsoft 365 tenants with IT-themed display names marked as "(Internal)" to bypass external-user warnings. Attacks frequently begin wi CVEs: CVE-2026-85102, CVE-2026-85103, CVE-2026-84869, CVE-2026-76461