Attackers Weaponise Microsoft Teams Guest Feature in Finance-Themed Phishing Campaign

Du'aine Davis

Observed in the wild

• On 22 January, Checkpoint Research identified that attackers launched a phishing campaign distributing 12,866 malicious Microsoft Teams guest invitations, impacting 6,135 users across 990 organisations daily. Primary victims included manufacturing/engineering (27.4%), technology/SaaS (18.6%), and education sectors (14.9%), predominantly in the United States (67.9%), Europe (15.8%), and Asia (6.4%). The campaign leveraged legitimate Microsoft Teams invitation emails to deliver fraudulent billing notifications appearing as authentic Microsoft services, prompting victims to contact fake support numbers regarding unauthorised subscription charges.
• Attackers created Microsoft Teams accounts and established teams with malicious names mimicking urgent billing notifications. They employed character obfuscation techniques including Unicode substitution and visually similar glyphs to evade automated detection whilst remaining readable to users. Exploiting the legitimate "Invite a Guest" feature, attackers sent invitations from genuine Microsoft addresses, with malicious team names displayed prominently in large fonts, creating convincing impersonations. Rather than deploying links, the campaign relied on phone-based social engineering directing victims to fraudulent support numbers.
• Organisations are advised to implement user awareness training emphasising scrutiny of unexpected Microsoft Teams invitations, particularly those containing urgent billing language, phone numbers, or unusual formatting/character substitutions. Configure Microsoft Defender to monitor anomalous Teams guest invitation patterns and block invitations from external domains with suspicious characteristics. Establish policies requiring verification through official channels before responding to financial notifications received via collaboration platforms. Monitor for behavioural indicators including multiple Teams invitations from unknown external users, team names containing payment terminology with obfuscated characters, and requests for immediate phone contact without legitimate ticketing systems.

Attackers Continue to Target Trusted Collaboration Platforms: 12,000+ Emails Target Teams Users - Check Point Blog

Du'aine Davis

Weaponising Zoom: A New TOAD Phishing Technique

Observed in the wild

• A recent campaign targeted general users by exploiting Zoom’s legitimate one‑time passcode (OTP) emails. Attackers created Zoom accounts with malicious display names containing urgent PayPal‑themed fraud messages. When login activity triggered an OTP email, it was forwarded to victims, who received what appeared to be a genuine Zoom communication, increasing the likelihood of calling the attacker-controlled number.
• The method relied on “living off the land” tactics: abuse of trusted cloud infrastructure, no malicious links, valid SPF/DKIM, and social‑engineering‑driven content embedded directly in display‑name fields. This created a “verified” Trojan horse that traditional Secure Email Gateways, which often whitelist Zoom, failed to detect. Attackers sought to induce panic and lure victims into telephone‑based fraud.
• Organisations are advised to detect behavioural discrepancies, such as content mismatched with the sending service, and to monitor for unusual Zoom display‑name patterns or unexpected OTP traffic. Defender‑aligned mitigations include tightening forwarding rules detections, enabling advanced anti‑phishing protection, reviewing anomalous authentication‑related emails.

When Zoom Phishes You: Unmasking a Novel TOAD Attack Hidden in Legitimate Infrastructure