Tag

Microsoft Teams

All articles tagged with #microsoft teams

technology1 month ago•3 min saved

Auth glitches halt Microsoft 365 services, hitting Exchange Online and linked apps

Microsoft is investigating a widespread outage causing authentication failures, connectivity issues, and email delays in Exchange Online, with broader impact on OneDrive for Business, SharePoint Online, Teams, Purview, and Defender XDR. The incident, tracked as MO1465074 (formerly EX1464935), affects tens of thousands of users per Downdetector. Microsoft says a common authentication/protocol failure pattern is under investigation and notes a core authentication configuration issue is being addressed with manual server resets as the scope and remediation continue.

via BleepingComputer|

#authentication #exchange-online #microsoft-365

security2 months ago•5 min saved

Teams Impersonations Fuel Chaos Ransomware Deployments Across North America

Sophos warns of STAC4749, a vishing campaign in which external Microsoft Teams calls impersonate IT staff to gain remote access, deploying backdoors and culminating in Chaos ransomware across dozens of North American organizations (Canada ~50%, US ~45%). Attackers used fake IT domains under the .top TLD, relied on Quick Assist or RemSupp, then PowerShell to install persistence and remote access tools like DWAgent/AnyDesk, with RDP used for lateral movement. Ransomware encrypts files and may accompany data theft; Chaos-as-a-service is linked to Conti offshoots. The techniques evolved to evade detection; no confirmed link to MuddyWater.

via BleepingComputer|

#chaos-ransomware #microsoft-teams #security

technology3 months ago•3 min saved

DragonForce Hides C2 Traffic in Microsoft Teams Relays with Backdoor.Turn

DragonForce-linked Backdoor.Turn uses Microsoft Teams’ TURN relay to hide its command-and-control traffic, obtaining an anonymous Teams token and establishing a QUIC connection to the attacker’s C2 server. The intrusion into a major U.S. services firm began with a BYOVD/DLL side-loading chain and included injection into DbgView64.exe for persistence, with initial access likely via an SQL/MS-SQL flaw or an initial access broker. The actors remained on the network for 1–2 months, illustrating a shift toward sophisticated, cartel-like ransomware operations.

via The Hacker News|

#backdoorturn #c2 #dragonforce

technology3 months ago•23 min saved

Teams adds Wi‑Fi presence to auto-scan office locations

Microsoft Teams is rolling out a feature called Workplace Check-in via Wi‑Fi that automatically updates a user’s work location when they connect to the organization’s corporate Wi‑Fi. The general availability rollout began in June 2026 (Roadmap ID 488800), extending the existing manual check-in by passively surfacing location within Teams. It’s available on Desktop and Mac across Worldwide Standard multi-tenant instances, but disabled by default and controlled by tenant admins. Users can opt in or out, ensuring a privacy-forward approach while helping coordinate in-person collaboration in hybrid work environments.

via CyberSecurityNews|

#hybrid-work #microsoft-teams #privacy

technology3 months ago•4 min saved

Ransomware hides C2 traffic in Teams relays to evade detection

Symantec reports DragonForce’s Go-based Backdoor.Turn ransomware is the first in-the-wild malware to abuse Microsoft Teams TURN relays to conceal its command-and-control traffic. After initial access via an SQL server vulnerability, the group used BYOVD drivers for kernel privileges, established persistence, exfiltrated data, and then deployed DragonForce ransomware, leveraging sophisticated tradecraft and publishing IoCs for defenders.

via BleepingComputer|

#backdoorturn #dragonforce #microsoft-teams

cybersecurity5 months ago•60 min saved

MuddyWater Uses Teams to Harvest Credentials and Subvert MFA in Chaos False-Flag Campaign

Security researchers describe a MuddyWater operation that exploited Microsoft Teams for external contact and screen-sharing to harvest user credentials (credentials.txt/cred.txt) and push MFA changes, followed by backdoor access using DWAgent and AnyDesk. The attackers deployed a custom RAT (Game.exe) and used C2 domains linked to MuddyWater, framing the intrusion as a Chaos ransomware false-flag campaign focused on credential theft and data exfiltration rather than encryption. The campaign featured indicators like a forged code-signing certificate and stolen credentials enabling lateral movement to Domain Controllers.

via CyberSecurityNews|

#credential-harvesting #cybersecurity #mfa

technology5 months ago•6 min saved

MuddyWater Uses Teams for Credential Theft in False-Flag Ransomware Operation

Rapid7 links MuddyWater to a 2026 operation that used interactive Teams screen-sharing to harvest credentials and bypass MFA, exfiltrate data, and maintain persistence with tools like DWAgent and AnyDesk, while avoiding file encryption to masquerade as a ransomware attack. Described as a false-flag, state-backed campaign, it leverages a Chaos RaaS framework and off-the-shelf tools to blur attribution, highlighting evolving attacker tradecraft that blends cybercrime with strategic aims.

via The Hacker News|

#cybersecurity #iran #microsoft-teams

cyber-security-news5 months ago•56 min saved

Threat Actors Weaponize Teams Messaging to Breach Enterprises

UNC6692 runs a multistage intrusion that begins with mass email bombardment and escalates via impersonation of IT staff in Microsoft Teams, guiding victims to a phishing landing page hosted on AWS S3. The campaign then harvests credentials, deploys a modular malware suite (SNOWBELT), and uses cloud-based C2 and data staging to exfiltrate data and compromise domain controllers, highlighting the need to restrict external Teams access and monitor cloud egress and browser extensions for anomalous activity.

via CyberSecurityNews|

#cyber-security-news #cybersecurity #microsoft-teams

technology5 months ago•6 min saved

Teams Tactics Drive UNC6692’s Modular SNOW Malware Campaign

Security researchers describe UNC6692’s two-stage assault: a flood of spam to overwhelm inboxes followed by impersonating IT staff via Microsoft Teams to coax victims into installing a patch that drops the SNOWBELT/SNOWGLAZE/SNOWBASIN malware suite for remote access, lateral movement, and data exfiltration, leveraging cloud services for C2 and payload delivery. The campaign targets executives and uses WebSocket tunnels and backdoors to expand access, with defenders urged to harden collaboration tools and enforce verified help-desk procedures.

via The Hacker News|

#microsoft-teams #snowbelt #snowglaze

tech5 months ago•44 min saved

Teams redesign targets accidental hand-raising with customizable controls

Microsoft Teams is getting a June rollout redesign that moves the Raise Hand button into the Reactions menu to reduce mis-clicks, and adds options to pin, unpin, and reorder meeting controls, with the Leave button clearly separated on the right to prevent accidental exits.

via The Verge|

#meeting-toolbar #microsoft-365-roadmap #microsoft-teams

technology8 months ago•3 min saved

Teams adds brand-impersonation warnings for external calls

Microsoft will roll out Brand Impersonation Protection for Teams Calling, automatically warning users on first-time external calls that try to impersonate trusted brands. Enabled by default in the targeted release mid-February, the feature lets users accept, block, or end flagged calls, with alerts possibly persisting during a conversation. It aims to curb social-engineering attacks and complements other security updates; no admin action is required for activation, though IT should update training materials.

via BleepingComputer|

#brand-impersonation-protection #caller-id #microsoft-teams

technology8 months ago•11 min saved

Microsoft outage hits Outlook and Teams as investigators probe network issues

Microsoft 365 services including Outlook, Teams and other apps experienced a widespread outage after thousands reported issues on Downdetector; Microsoft said it was investigating and cited a possible third‑party networking issue. By about 18:44 UTC the company said the incident was resolved and the service environment remained healthy, though a small number of users continued to report sign‑in or access problems (with some Xbox app/store issues on iPad).

via Daily Express|

#microsoft #microsoft-365 #microsoft-teams

technology9 months ago•2 min saved

Microsoft Teams to Implement Enhanced Security Features and External User Controls by January 2026

Microsoft Teams will soon allow security admins to block external users from messaging or calling within Teams via integration with Defender for Office 365, enhancing security and control over external communications. The feature, rolling out in January 2026, supports managing up to 4,000 blocked domains and 200 email addresses, and aims to prevent cyberattacks like social engineering and ransomware.

via BleepingComputer|

#block-list #defender-portal #external-users

technology9 months ago•2 min saved

Microsoft Teams to Implement Default Messaging Safety in January 2026

Microsoft will automatically enable key messaging safety features in Teams starting January 2026 to enhance security by blocking high-risk file types, scanning URLs for malicious content, and allowing users to report false positives, with organizations able to opt out beforehand.

via CybersecurityNews|

#cybersecurity #default-settings #messaging-safety

technology11 months ago•2 min saved

Microsoft Teams Vulnerabilities Enable Impersonation, Message Tampering, and Data Theft

Cybersecurity researchers revealed four security vulnerabilities in Microsoft Teams that could allow attackers to impersonate colleagues, manipulate messages without detection, and exploit notifications, posing significant social engineering risks. Some issues have been patched, but the flaws highlight the importance of securing collaboration tools against trust-based attacks, especially as threat actors increasingly target enterprise communication platforms.

via The Hacker News|

#cybersecurity #impersonation #microsoft-teams