Microsoft Teams Impersonation and Spoofing Vulnerabilities Exposed

MITRE Techniques

• [T1195 ] Supply Chain Compromise – The article notes threat actors targeting widely-used platforms as part of broader campaigns, highlighting supply chain risks. (‘Supply chain attacks targeting widely-used software platforms’)
• [T1566 ] Phishing (Social Engineering) – Attackers use trusted communication channels and social engineering tactics via Teams to deceive users and induce actions. (‘Social engineering campaigns leveraging trusted communication channels’)
• [T1566.003 ] Spearphishing via Service – The research demonstrates crafting payloads (e.g., bot/webhook messages) that spoof senders within the Teams interface to impersonate trusted users. (‘we developed a proof-of-concept showing how a malicious bot or webhook could craft payloads with falsified “from” attributes’)
• [T1589 ] Gather Victim Identity Information – Techniques described include credential harvesting and impersonation to obtain sensitive identity-related data for fraud or access. (‘Credential harvesting operations targeting remote workforce tools’)
• [T1204 ] User Execution – Malware delivery scenarios rely on users clicking malicious links or executing content delivered via spoofed Teams messages or notifications. (‘Malware Delivery: Attackers can send a spoofed notification… asking for urgent action or clicking a link, which then installs malware.’)
• [T1041 ] Exfiltration Over Command and Control (Data Exfiltration) – The report links manipulated communications to potential data exfiltration and advanced persistent threat activity. (‘Advanced Persistent Threats and Data Exfiltration’)
• [T1036 ] Masquerading – Impersonation and forged caller/display names in messages and calls reflect masquerading techniques to appear as legitimate internal users. (‘an attacker could convincingly appear to be the CEO’)
• [T1078 ] Valid Accounts – The findings show both guest accounts and malicious insiders abusing legitimate account contexts to bypass trust boundaries. (‘both external guest users and internal malicious actors can effectively transform their identity to appear as trusted personnel’)
• [T1565 ] Stored Data Manipulation – The ability to edit messages without leaving an “Edited” label and to alter conversation topics represents manipulation of stored message data. (‘Edit Messages Without Trace: We discovered a method to alter the content of sent messages without leaving the usual “Edited” label.’)