Microsoft Teams Security Incidents, Breaches and Attacks: A Timeline from 2020 to 2026

We count 16 notable Microsoft Teams security events between 2020 and November 2026. The most serious was not a Teams bug: Russia's Midnight Blizzard broke into Microsoft's own corporate email in late 2023 and later reached some of its source code. We found no public report that a flaw in the Teams service itself leaked customers' chat content at scale. Teams data was exposed when attackers took over accounts, and Teams has become a favourite channel for phishing and fake-helpdesk calls.

This post keeps two things apart: breaches of Microsoft itself, and attacks that used Teams as a channel to reach someone else's employees. It also lists the Teams vulnerabilities researchers found, none of which Microsoft marks as exploited. For how Teams encryption works, see is Microsoft Teams end-to-end encrypted?

Timeline of Microsoft Teams Security Incidents

Sources: Microsoft Security Blog and MSRC, Microsoft Security Update Guide, CISA, US Department of Homeland Security, CyberArk, Vectra, Check Point Research, Google Threat Intelligence Group, Palo Alto Networks Unit 42, Sophos and BleepingComputer. Full links are in Sources & References below.

Breaches of Microsoft Itself

These incidents happened inside Microsoft. Neither was a Teams breach, but both bear on how much you trust the company that holds your Teams data.

Storm-0558 and the stolen signing key (2023)

From 15 May 2023, a China-based group Microsoft calls Storm-0558 used an acquired Microsoft consumer (MSA) signing key, plus a token validation flaw, to forge authentication tokens. Microsoft said the group accessed email through Outlook Web Access in Exchange Online and Outlook.com at about 25 organizations, including government agencies. A customer, not Microsoft, spotted it on 16 June 2023.

Microsoft named only email services. Cloud security firm Wiz argued the same key could have been used to forge tokens for other Microsoft apps, including Teams. A Microsoft spokesperson called many of Wiz's claims "speculative and not evidence based." No public evidence shows Teams data was accessed.

The Cyber Safety Review Board report (April 2024)

The US Cyber Safety Review Board, convened by the Department of Homeland Security, reviewed Storm-0558 and published its report on 2 April 2024. It found the intrusion "was preventable" and pointed to "a corporate culture that deprioritized enterprise security investments and rigorous risk management." The board also noted Microsoft still could not say how the key was stolen.

Midnight Blizzard inside Microsoft's corporate email (2023-2024)

On 12 January 2024, Microsoft detected that Midnight Blizzard, the Russian state group also known as APT29 or NOBELIUM, had been in its corporate systems since late November 2023. The group used a password spray to compromise a "legacy non-production test tenant account," then reached "a very small percentage of Microsoft corporate email accounts," including senior leadership and the cybersecurity and legal teams, and "exfiltrated some emails and attached documents."

In a March 2024 update, Microsoft said the group had used what it stole to gain or attempt access to "some of the company's source code repositories and internal systems," and that some secrets "shared between customers and Microsoft in email" were among the stolen data. In April 2024, CISA ordered US federal agencies to review their correspondence with Microsoft and reset any exposed credentials (Emergency Directive 24-02). Microsoft said it found no evidence that "Microsoft-hosted customer-facing systems have been compromised," so this was not a breach of customers' Teams data.

Attacks That Used Teams as a Channel

Most real-world Teams incidents follow one pattern. Teams lets people in other Microsoft 365 organizations find and message your staff: Microsoft's documentation says "Allow all external domains" is "the default setting in Teams." Attackers create or hijack a tenant, give it an official-sounding name, and message employees directly.

Midnight Blizzard's Teams phishing (2023)

On 2 August 2023, Microsoft reported that Midnight Blizzard had targeted "fewer than 40 unique global organizations" since late May. The group used small-business Microsoft 365 tenants it had already compromised, renamed them, and added onmicrosoft.com subdomains with words like "msftprotection." It then sent Teams chat requests posing as technical support or security staff and talked targets into entering a code into Microsoft Authenticator, which handed the attacker a sign-in token. Microsoft said it blocked the domains and notified affected customers.

Storm-0324 and DarkGate malware (2023)

From July 2023, Microsoft saw the ransomware access broker Storm-0324 send Teams lures linking to malicious files on SharePoint, most likely using a public tool called TeamsPhisher. In late August, Truesec reported a separate campaign that sent HR-themed ZIP files, such as "Changes to the vacation schedule," from two compromised external Office 365 accounts to deliver the DarkGate loader. Microsoft responded by suspending fraudulent tenants, making the external sender clearer in the chat Accept/Block screen, and restricting new domain creation in tenants.

Storm-1811, Black Basta and the fake IT helpdesk (2024-2025)

In May 2024, Microsoft described Storm-1811, a group linked to Black Basta ransomware, flooding victims' inboxes with spam and then calling as IT support to "fix" it through Quick Assist. By the end of May 2024, Microsoft saw the group "using Microsoft Teams to send messages to and call target users." In January 2025, Sophos reported two clusters using the same playbook in more than 15 incidents, relying on the default setting that lets outside users start Teams chats and calls; in one case Sophos blocked an attempt to deploy Black Basta.

Void Blizzard reading Teams chats (2024-2025)

In May 2025, Microsoft reported a Russia-affiliated group, Void Blizzard, that mostly gets in with password spraying and stolen credentials. "In a small number of Void Blizzard compromises," Microsoft observed it "accessing Microsoft Teams conversations and messages via the Microsoft Teams web client application." This is the clearest documented case of Teams message content being read by an attacker, and it came from account takeover, not a Teams flaw.

The 2025-2026 helpdesk impersonation wave

The fake-helpdesk pattern kept growing:

• November 2025: Microsoft's incident response team (DART) handled a case where an attacker posing as IT support on Teams failed twice, then "convinced a third user to grant remote access through Quick Assist." Microsoft says the attacker was evicted with no identity or directory-level impact.
• December 2025 to April 2026: Google Threat Intelligence Group and Mandiant tracked UNC6692, which email-bombed targets, offered help over Teams from an outside account, and sent a fake "Mailbox Repair and Sync Utility." At one victim it went on to steal the Active Directory database from a domain controller.
• January to April 2026: Palo Alto Networks Unit 42 reported "Spring Ring," which approached more than 150 employees across more than 10 tenants using external Teams accounts and lookalike onmicrosoft.com names. Unit 42 says the payloads it saw were blocked.
• September 2026: Microsoft described a campaign that used Teams chats and calls with lures such as "Microsoft Security Update," installed a Node.js implant after the user granted remote control, and then moved over WinRM to "dozens of hosts."

Microsoft has added controls and tightened some defaults in response. Since February 2026, security admins can block external Teams users and domains from the Microsoft Defender portal. From mid-September 2026, Teams limits outbound external messages from organizations that only use the default onmicrosoft.com domain, to curb "spam, phishing, and other abusive activity."

Teams Vulnerabilities Found by Researchers

Microsoft's Security Update Guide lists 23 CVEs with "Teams" in the title from 2020 to September 2026. As of 7 November 2026, none is marked as exploited.

The GIF account takeover (2020)

CyberArk found that two Teams subdomains, aadsync-test.teams.microsoft.com and data-dev.teams.microsoft.com, could be taken over. Because Teams sent an authentication cookie to any teams.microsoft.com subdomain, simply viewing a GIF hosted there could hand an attacker a token to read and send messages as the victim. CyberArk reported it on 23 March 2020; Microsoft fixed the DNS records that day and shipped a patch on 20 April 2020. No exploitation was reported.

Plaintext tokens in the desktop app (2022)

In September 2022, Vectra reported that "all commercial and GCC Desktop Teams clients for Windows, Mac, and Linux" stored active access tokens in plaintext files, so anyone or any malware able to read those files could act as the user, even with MFA on. Vectra said Microsoft "indicated it did not meet their bar for immediate servicing."

GIFShell (2022)

Also in September 2022, researcher Bobby Rauch showed how Teams could carry commands hidden in GIFs to malware already on a device and smuggle data out through GIF filenames, along with ways to disguise attachments. Microsoft told BleepingComputer the techniques "do not meet the bar for an urgent security fix," noting they require an already compromised device.

Check Point's spoofing flaws (2024-2025)

Check Point Research reported four flaws to Microsoft on 23 March 2024: editing sent messages without the "Edited" label, spoofing the sender name on notifications (CVE-2024-38197), changing the displayed name in private chats, and forging caller identity in calls. Microsoft fixed them between May 2024 and October 2025, and Check Point published in November 2025. No exploitation was reported.

Critical cloud-side fixes (2026)

In February 2026, Microsoft fixed CVE-2026-21535, an improper access control flaw that "allows an unauthorized attacker to disclose information over a network" (CVSS 8.2). In August 2026 it fixed three critical Teams flaws: CVE-2026-65667 (elevation of privilege, CVSS 10.0), CVE-2026-62896 (elevation of privilege, 9.6) and CVE-2026-62918 (spoofing, 7.5). All were fixed in Microsoft's service with no customer action required, and none is marked as exploited or publicly disclosed beforehand.

What the Incidents Have in Common

• Open external access. Almost every attack on Teams users started with a chat or call from another tenant, which the default "Allow all external domains" setting permits.
• Impersonating IT support. Midnight Blizzard, Storm-1811, UNC6692 and the 2026 campaigns all posed as helpdesk or security staff, often after flooding the inbox with spam.
• Remote access tools and MFA prompts. The goal was usually a Quick Assist session, a remote-control request or an approved Authenticator code, not a software exploit.
• Stolen credentials and tokens. Void Blizzard and both Microsoft breaches began with password spraying, stolen credentials or a stolen key.

Would end-to-end encryption have helped? Partly, and only for some incidents. It would not have stopped any of the phishing or helpdesk attacks: the victim is a real participant in the chat, so encryption delivers the attacker's message faithfully. It would not help when an attacker signs in as the user on their device, as Void Blizzard did. Where it does matter is server-side compromise: if Teams chats were end-to-end encrypted, a stolen signing key, a compromised admin account or a cloud flaw like the 2026 information disclosure bugs could not expose message content, because the server would hold only ciphertext. Metadata, such as who talks to whom and when, would still be visible.

How to Protect Your Teams Tenant

These steps come mostly from Microsoft's own guidance in its 2023-2026 threat reports and Teams documentation.

1. Restrict external access. In the Teams admin center under Users, External access, switch from "Allow all external domains" to "Allow only specific external domains" for the partners you work with. If you can't, block known-bad domains and turn off inbound chats from unmanaged Teams accounts.
2. Let security block domains quickly. Turn on "Allow my security team to manage blocked domains" so blocks can be added in the Microsoft Defender Tenant Allow/Block List.
3. Check external file sharing. Microsoft is changing the default so file attachments are enabled in external chats unless you have set it yourself. If you want them off, set FileSharingInChatsWithExternalUsers to Disabled in your Teams files policy.
4. Remove Quick Assist and unused remote tools. Microsoft recommends disabling or removing Quick Assist where it isn't needed and inventorying remote monitoring tools.
5. Use phishing-resistant MFA. Require it through Conditional Access, and allow access only from managed devices. See our two-factor authentication guide.
6. Turn on Defender protections for Teams. Safe Links, Safe Attachments and zero-hour auto purge, which Microsoft says "can retroactively detect existing malicious chat messages in Teams."
7. Train staff on one rule. Your IT team will not contact you from an external tenant. Check the "External" label, never read out a Quick Assist code or approve a sign-in you didn't start, and confirm through a known internal channel.

Frequently Asked Questions

Final Takeaway

Teams' record is mostly one of attackers abusing its openness rather than breaking its code: external chats from lookalike tenants, fake helpdesk calls and stolen credentials. Locking down external access and remote tools removes most of that risk. The breaches of Microsoft itself are a separate reminder that data a provider can read is only as safe as that provider. If you want team messages the server can't read, compare options in Lupyd vs Microsoft Teams and which messaging apps are end-to-end encrypted.

Lupyd end-to-end encrypts DMs with the Signal Protocol and group channels with MLS, though the server still sees group membership and names, group calls are not yet end-to-end encrypted, and it is a young product with no external security audit yet. Encryption won't stop phishing on any app. Try Lupyd.

Sources & References

• Beware of the GIF: Account Takeover Vulnerability in Microsoft Teams, CyberArk, April 2020
• Microsoft Teams flaw could let attackers take over accounts with a GIF, WeLiveSecurity (ESET), 27 April 2020
• Undermining Microsoft Teams Security by Mining Tokens, Vectra, 13 September 2022
• GIFShell attack creates reverse shell using Microsoft Teams GIFs, BleepingComputer, 8 September 2022
• Microsoft mitigates China-based threat actor Storm-0558 targeting of customer email, MSRC, 11 July 2023
• Compromised Microsoft Key: More Impactful Than We Thought, Wiz, July 2023
• Midnight Blizzard conducts targeted social engineering over Microsoft Teams, Microsoft Threat Intelligence, 2 August 2023
• Malware distributor Storm-0324 facilitates ransomware access, Microsoft Threat Intelligence, 12 September 2023
• Microsoft Teams phishing attack pushes DarkGate malware, BleepingComputer, September 2023 (reporting Truesec's findings)
• Microsoft Actions Following Attack by Nation State Actor Midnight Blizzard, MSRC, 19 January 2024
• Update on Microsoft Actions Following Attack by Nation State Actor Midnight Blizzard, MSRC, 8 March 2024
• Emergency Directive 24-02, CISA, 2 April 2024
• Cyber Safety Review Board Releases Report on Microsoft Online Exchange Incident from Summer 2023, US Department of Homeland Security, 2 April 2024
• Threat actors misusing Quick Assist in social engineering attacks leading to ransomware, Microsoft Threat Intelligence, 15 May 2024 (updated June 2024)
• Sophos MDR tracks two ransomware campaigns using "email bombing," Microsoft Teams "vishing", Sophos, 21 January 2025
• New Russia-affiliated actor Void Blizzard targets critical sectors for espionage, Microsoft Threat Intelligence, 27 May 2025
• Disrupting threats targeting Microsoft Teams, Microsoft Security Blog, 7 October 2025
• Microsoft Teams impersonation and spoofing vulnerabilities exposed, Check Point Research, 4 November 2025
• Help on the line: How a Microsoft Teams support call led to compromise, Microsoft Incident Response, 16 March 2026
• UNC6692 social engineering and custom malware, Google Threat Intelligence Group and Mandiant, 24 April 2026
• Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams, Palo Alto Networks Unit 42, 31 August 2026
• Impersonating IT support: how threat actors turn a remote session into enterprise-wide access, Microsoft Security Blog, 2 September 2026
• CVE-2026-21535, CVE-2026-65667, CVE-2026-62896, CVE-2026-62918 and CVE-2024-38197, Microsoft Security Update Guide
• Manage external meetings and chat with people and organizations using Microsoft identities, Microsoft Learn
• MC1200058: Admins can block external users in Microsoft Teams from Defender portal, MC1463510: External messaging limits for onmicrosoft.com-only organizations and MC1479514: File sharing enabled by default in external chats, Microsoft 365 Message Center (archived copies)

Last updated: 7 November 2026.