Microsoft Teams Hack Report Shows Old-School Attacks Are Still a Thing
Over the last year, the public has been trained to view the biggest new wave of emerging cyberthreats as AI-driven. In fact, frontier AI models accelerating the pace of cyberattacks — and even jumping ahead so far that the models have to be paused in the case of Anthropic’s Mythos — have driven the cybersecurity conversation recently.
But a recent report from Microsoft detailing how hackers used its Teams software to infiltrate corporate systems shows that human hackers are still using social engineering scams to fool other humans into doing their dirty work.
According to the report, “threat actors used Microsoft Teams messages and calls to impersonate IT or help desk personnel and socially engineer users into granting interactive remote access, primarily through Quick Assist.” Once they were granted access by unsuspecting workers, the hackers were able to set up software using Python, Bun or Java runtimes, open up networks and grant themselves authentication, giving them free rein over corporate systems.
More from CNET
In order to open the door to all that activity, however, a human had to grant access to the intruder. “Both incidents began with Teams phishing messages and calls that impersonated support personnel,” the report stated. “The social engineering persuaded a user to establish an attacker-controlled remote session, primarily by guiding the user to open Quick Assist and provide the connection code. This gave the attacker hands-on-keyboard access to the workstation.” Presumably, the employees who granted access thought the people on the help desks reaching out were just doing their jobs to keep their workplaces safe and operations running smoothly.
Microsoft suggests verifying external IDs
In an email to CNET, a representative for Microsoft said the company is introducing AI-powered phishing detection that it says “uses conversation context to identify phishing and social engineering in higher-risk messaging scenarios, particularly first-contact chats with external users.”
The change was listed as part of Microsoft’s roadmap for the software, which was revealed last month. Teams will also add ways to report suspicious guest invitations and blur QR codes sent by external senders, according to that roadmap.
However, a lot of the burden of making sure these hackers don’t get through falls to companies and their employees. “Users should exercise caution with external connection requests and messages, including verifying a sender’s identity and requests before acting on them,” Microsoft’s spokesperson said. “Administrators can also block external Teams users and specify which users in their organization are permitted to chat or meet with people outside the enterprise.”
Human-led attacks can harness AI, too
Yu Cai, associate director of the Institute of Computing and Cybersystems at Michigan Tech, said social engineering attacks are definitely still widespread. “AI may be changing the cybersecurity landscape, but it hasn’t replaced the human hacker. Human-led social engineering attacks remain a major cybersecurity threat, even as AI cyber attacks continue to get the bulk of today’s headlines,” he said.
But Cai said AI attacks and human-led attacks aren’t necessarily in separate buckets. AI can help make social engineering hacks more convincing by providing tools like voice cloning or deepfake videos.
In the case of the Microsoft Teams hacks, Cai said that what was most surprising was how simple the approach was to gain access. “This is a great reminder that sophisticated attacks don’t necessarily have to begin as sophisticated hacks,” he said. “This Microsoft incident wasn’t caused by any vulnerabilities in the Teams software, but by employees naturally placing trust in communications that come through the tools they use each and every day.”
Omar Gallaga has covered technology, digital culture and other topics for outlets including CNET, NPR, Wired, Texas Monthly, MSNBC, Consumer Reports, The Washington Post, the Los Angeles Times, The Atlantic and the Austin American-Statesman, where he was a longtime tech reporter, editor and podcaster. He lives in the Texas Hill Country. See full bio
The Latest from Omar
KioskNews shows a cleaned-up reading view extracted from the publisher’s page — the original always lives on their site, not ours.