Cybercriminals are using Microsoft Teams to impersonate IT support staff and execute malicious payloads in under 15 minutes, according to new research from cybersecurity firm Arctic Wolf.

The company documented more than 400 incidents involving the abuse of Teams’ external chat functionality, highlighting how attackers are increasingly exploiting legitimate workplace tools to gain access to corporate networks.

The findings come alongside Arctic Wolf’s 2026 Agentic Security Operations Report, which reveals that artificial intelligence now autonomously resolves 60% of security investigations within the company’s security operations centre (SOC).

Exploiting Trust in Microsoft Teams

According to Arctic Wolf’s investigation, attackers frequently begin by flooding employees’ inboxes with hundreds of spam emails before contacting them through Teams, posing as internal IT support offering to resolve the issue.

The attackers use convincing display names, including references to internal helpdesks, to disguise their identities and encourage employees to grant remote access to their devices.

Once contact is established, victims may be persuaded to use legitimate remote-support software, such as Microsoft Quick Assist, allowing attackers to execute malicious code, steal credentials or establish persistent access.

Researchers found that attackers could progress to payload execution in less than 15 minutes after a victim engaged with the initial message.

Crucially, the technique does not rely on exploiting a software vulnerability. Instead, attackers abuse Teams’ legitimate external communication features and employees’ trust in familiar workplace platforms.

Arctic Wolf also observed attackers targeting multiple employees within minutes of each other, suggesting the use of automation to increase their chances of success.

AI Reshaping Security Operations

The speed of these attacks reflects a wider challenge facing cybersecurity teams, with traditional, human-led investigations struggling to keep pace with increasingly sophisticated threats.

Arctic Wolf’s latest report, drawing on data from more than 11,000 organisations across over 100 countries, suggests agentic AI is significantly changing how security operations are conducted.

Within the company’s own SOC, AI now independently resolves 60% of security investigations, while a further 38% involve collaboration between AI systems and human analysts.

The proportion of investigations handled entirely by humans has fallen from 81% to just 2% over the past year.

Despite monthly investigation volumes increasing by 21%, Arctic Wolf reported a 19% reduction in alert volumes, while the average time between a security event and the creation of an actionable ticket fell by 36%.

The findings suggest that automated investigation systems could help organisations manage growing security workloads without overwhelming human analysts.

Recommended reading

• How Is AI Impacting Traditional Hiring?
• UK Firms Battle For AI Talent In Rapid Hiring Surge
• PwC: Firms Now Pay a 56% Premium for AI Talent

Dan Schiappa, President of Technology and Services at Arctic Wolf, said: “The reality of today’s threat landscape is that attackers are already operating at machine speed.”

However, the report also highlights the importance of maintaining human oversight, particularly when AI systems encounter unfamiliar threats or cannot confidently determine the appropriate response.

Closing the Security Gap

With attackers exploiting trusted platforms and moving rapidly from initial contact to compromise, the findings underline the importance of combining automated detection with established security practices.

Arctic Wolf recommends that organisations restrict Microsoft Teams’ external communication to trusted domains, limit access to remote-support tools and establish independent verification procedures for unexpected IT support requests.

The company also emphasises the need for monitoring across collaboration platforms, endpoints and identity systems to identify suspicious activity before attackers can establish control.