This serious Microsoft Teams security flaw could let external accounts infect your calls, so beware

(Image credit: Shutterstock / Sashkin)

Users have been warned that Microsoft Teams has a security vulnerability that could be abused as a vector for delivering malware.

Security researchers at Jumpsec discovered a way to use the video conferencing software to inject malware into an organization's network from a Teams account that is outside of the organization in question.

Using default configurations, the attack leverages the ability of an organization's Microsoft Teams client to accept communications from 'external tenants' - those using Teams accounts from outside the company.

Protecting your business from the biggest threats online

Protecting your business from the biggest threats online
Perimeter 81's Malware Protection intercepts threats at the delivery stage to prevent known malware, polymorphic attacks, zero-day exploits, and more. Let your people use the web freely without risking data and network security.

Microsoft Teams external communications

The Jumpsec report notes that while this exploit can be used to perpetrate social engineering and phishing attacks, it can also be used to send malware payloads to another inbox, despite Teams having protections to block files coming from external tenants.

The researchers found a way to bypass these restrictions, by altering the recipient ID both internally and externally in the POST request of a message, tricking Teams into thinking an external account is actually internal. 

During their tests, the researchers were able to successfully deliver a command and control payload into another organization's inbox, as part of a covert operation. 

There is no need to bother with crafting a convincing phishing message to lure the victim, and if the threat actor were to register a domain similar to the target's, then it may fool workers into thinking the link came from within the company, and therefore safe to download. 

After reporting the exploit to Microsoft, the tech giant responded that "it does not meet the bar for immediate servicing," signifying the relatively low risk it thinks it poses. It has not yet confirmed when it will likely provide a patch. 

Communication with external tenants can be disabled by navigating to the Microsoft Teams Admin Center and then to External Access. If you do not wish to block all external communications, then you can choose to communicate with trusted domains only by adding them to the allow list. 

The researchers also submitted their findings to the Microsoft Teams feedback portal, where users can up-vote the post in the hope of pressing Microsoft to attend to the issue quicker. 

Lewis Maddison
Reviews Writer

Lewis Maddison is a Reviews Writer for TechRadar. He previously worked as a Staff Writer for our business section, TechRadar Pro, where he had experience with productivity-enhancing hardware, ranging from keyboards to standing desks. His area of expertise lies in computer peripherals and audio hardware, having spent over a decade exploring the murky depths of both PC building and music production. He also revels in picking up on the finest details and niggles that ultimately make a big difference to the user experience.