This serious Microsoft Teams security flaw could let external accounts infect your calls, so beware

(Image credit: Shutterstock / Sashkin)

Users have been warned that Microsoft Teams has a security vulnerability that could be abused as a vector for delivering malware.

Security researchers at Jumpsec discovered a way to use the video conferencing software to inject malware into an organization's network from a Teams account that is outside of the organization in question.

Using default configurations, the attack leverages the ability of an organization's Microsoft Teams client to accept communications from 'external tenants' - those using Teams accounts from outside the company.

Protecting your business from the biggest threats online

Protecting your business from the biggest threats online
Perimeter 81's Malware Protection intercepts threats at the delivery stage to prevent known malware, polymorphic attacks, zero-day exploits, and more. Let your people use the web freely without risking data and network security.

Microsoft Teams external communications

The Jumpsec report notes that while this exploit can be used to perpetrate social engineering and phishing attacks, it can also be used to send malware payloads to another inbox, despite Teams having protections to block files coming from external tenants.

The researchers found a way to bypass these restrictions, by altering the recipient ID both internally and externally in the POST request of a message, tricking Teams into thinking an external account is actually internal. 

During their tests, the researchers were able to successfully deliver a command and control payload into another organization's inbox, as part of a covert operation. 

There is no need to bother with crafting a convincing phishing message to lure the victim, and if the threat actor were to register a domain similar to the target's, then it may fool workers into thinking the link came from within the company, and therefore safe to download. 

After reporting the exploit to Microsoft, the tech giant responded that "it does not meet the bar for immediate servicing," signifying the relatively low risk it thinks it poses. It has not yet confirmed when it will likely provide a patch. 

Communication with external tenants can be disabled by navigating to the Microsoft Teams Admin Center and then to External Access. If you do not wish to block all external communications, then you can choose to communicate with trusted domains only by adding them to the allow list. 

The researchers also submitted their findings to the Microsoft Teams feedback portal, where users can up-vote the post in the hope of pressing Microsoft to attend to the issue quicker. 

Lewis Maddison
Staff Writer

Lewis Maddison is a Staff Writer at TechRadar Pro. His area of expertise is online security and protection, which includes tools and software such as password managers. 

His coverage also focuses on the usage habits of technology in both personal and professional settings - particularly its relation to social and cultural issues - and revels in uncovering stories that might not otherwise see the light of day.

He has a BA in Philosophy from the University of London, with a year spent studying abroad in the sunny climes of Malta.