:quality(90):no_upscale()){kind=logo}
Four Campaigns Show Communication Channels Have Become an Initial Access Vector
STATUS: Active Social Engineering Pattern SEVERITY: 6/10 AUDIENCE: Government, Defense, Critical Infrastructure Security Leads
Nov 6, 2026
·Blog
·Secure Communications
:quality(90):no_upscale())
Since August, attackers impersonating IT help desks and trusted contacts have used phone calls, enterprise chat, consumer messaging apps, and a device-linking prompt to reach staff directly. In each campaign, initial access depended on persuasion. The common requirement was a channel that lets an outsider start a conversation.
What Happened
In all four campaigns, the attacker reached a person through a channel the organization uses and trusts.
In September, Arctic Wolf disclosed a campaign it tracks as PREY-0058 in which operators impersonating internal IT help desk staff call directors, vice presidents, and other executives, then direct them to a fake Microsoft 365 sign-in page that captures session tokens. No malware is deployed and the operators pull data from SharePoint, OneDrive, and Exchange for extortion.1
In October, Arctic Wolf reported a recurring pattern across hundreds of cases in which attackers open Microsoft Teams external chats from throwaway tenants using names such as “IT Support (Internal),” often after flooding the victim's inbox to create urgency. They talk the victim into granting remote access through legitimate remote management tools and, in some cases, the intrusion reached domain controllers and ended in data theft and ransomware. Arctic Wolf's summary is that the vector works because it exploits trust, not a software flaw.2
Also in September, the FBI, the UK's NCSC, and the Netherlands' AIVD each warned that state-sponsored actors impersonate a target's trusted contacts inside popular messaging apps, spend time building rapport, and then send a malicious file disguised as something ordinary.3 In August, reporting on an internal EU cyber presentation described account takeovers involving senior officials on WhatsApp and Signal by a foreign government, with eight significant incidents this year and a sitting national parliament president's account among the confirmed breaches. Attackers persuaded targets to hand over a code that linked a second device to the account.4
Across all four, attackers presented as someone such as an IT help desk or a known contact with a legitimate reason to ask through a channel that accepts contact from outsiders. Training that teaches staff to spot unfamiliar senders has little to work with and link scanning and endpoint detection have little to inspect when the attacker steers the victim to do the work themselves.
What They Found and What It Means
Finding | What It Means | Operational Consequence | Open Question |
Four separate campaigns since August reached staff through a phone call, enterprise chat, consumer messaging apps, and a device-linking prompt. | Attackers choose whichever channel gives them direct access to a person and the channel changes from one campaign to the next. | Defenses concentrated on one channel, such as email, leave the others open. | How many organizations have a written rule for who may contact staff through each channel and how staff can verify it? |
In every case the attacker impersonated IT support or a trusted contact. | The attack succeeds on credibility so warnings about unfamiliar senders and link scanning have little to act on. | Staff cannot reliably tell a real IT request from a fake one when both arrive in the same channel. | Whether the organization gives staff a separate, verified way to confirm that a request really came from IT or security? |
Arctic Wolf found the Teams campaigns target organizations with external access enabled and attackers avoid pasting links so that Safe Links scanning has nothing to inspect. | Platform-side scanning cannot catch an attack carried out by a person in a live chat or remote session. | Detection has to come from endpoint and identity activity after the contact and prevention from limiting who can contact staff at all. | Whether organizations have reviewed external chat and federation settings since these campaigns began? |
Why This Matters
Old Assumption | Current Reality | BlackBerry Response |
Security awareness training that teaches staff to be suspicious of unknown senders protects against social engineering. | In these campaigns the contact appears to come from IT support or a known contact so there is no unknown sender to be suspicious of. | BlackBerry® SecuSUITE® enrollment is administered by the organization, allowing sensitive coordination to take place in a channel where contacts are known and managed rather than open to outsiders. |
If a request looks like it came from IT, staff can ask IT to confirm it in the same channel. | The attacker controls the conversation and in the Teams cases the fake IT identity sits in the same chat window where a real one would appear. | BlackBerry® AtHoc® gives IT and security a way to send genuine notices to staff on a separate channel so a staff member can check whether a request is real. |
Platform protections such as link scanning and external-user warnings catch social engineering carried out inside the platform. | Attackers use display names that subvert external-user warnings and move the work into a live remote session, so the platform sees nothing malicious to block. | Where BlackBerry® UEM manages the endpoint, it can restrict unauthorized remote access software which narrows the step where these attacks hand over control. |
Recommended Actions
IMMEDIATE | Review Microsoft Teams external access and federation settings and restrict external chat to named, approved domains where possible. |
IMMEDIATE | Publish a short rule for staff on how IT and security will and will not contact them. State that IT does not ask for remote access through an unsolicited chat or call, and give staff a way to verify legitimate requests. |
SHORT-TERM | Restrict and monitor remote management tools on endpoints since the Teams campaigns depend on staff running tools such as Quick Assist, AnyDesk, and ScreenConnect. |
SHORT-TERM | Give executives and administrators a verified channel for IT and security notices that is separate from email and chat. |
ONGOING | Track social engineering campaigns by channel as well as by technique so a gap in one channel is closed before attackers reach it. |
BlackBerry Position
Campaigns across a phone line, enterprise chat, consumer messaging apps, and a device-linking prompt shared one structure: an outsider got a conversation with a staff member and used it. Technical controls on a platform have little to inspect when the attack is a conversation. The more important control is who is allowed to start that conversation. Organizations can narrow the opening these campaigns depend on by running sensitive coordination in channels where enrollment and contacts are administered and giving staff a separate way to verify genuine IT and security requests.
Citations:
1. Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks. (Arctic Wolf, PREY-0058 threat research, as reported by The Hacker News, September 7, 2026).
2. Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware. (Arctic Wolf Labs, research on threat actors abusing Microsoft Teams external chat for initial access, as reported by The Hacker News, October 26, 2026).
3. Iranian Cyber Targeting of Dissidents, Activists and Journalists. (UK National Cyber Security Centre, United States Federal Bureau of Investigation, and the Netherlands' General Intelligence and Security Service, Joint Cybersecurity Advisory, September 15, 2026).
4. State-backed hackers targeted EU officials on WhatsApp, document shows. (Politico, internal EU cyber presentation findings, as reported by TheNextWeb, August 2026, and Dark Reading, coverage of national agency warnings on Signal and WhatsApp campaigns, August 25, 2026).
:quality(90):no_upscale())