Hackers Exploiting Microsoft Teams Notifications to Deliver CallBack Phishing Attack

Cybersecurity researchers have identified a sophisticated phishing campaign that exploits Microsoft Teams notifications to deceive users into calling fraudulent support numbers.

The attack demonstrates how legitimate communication platforms can be weaponized to bypass security defenses and email filters.

According to SpiderLabs, threat actors are abusing Microsoft Teams to add users to groups with deceptive team names containing fake financial content.

These team names impersonate urgent payment issues, including counterfeit invoices, auto-renewal notices, or unauthorized PayPal charges.

Once added to these groups, victims receive notification emails that appear to come from legitimate Microsoft Teams infrastructure, sent to no-reply@teams.mail.microsoft.

The notifications contain a critical detail prompting users to contact a fake support number if they did not authorize the charge.

Because the emails originate from an official Microsoft domain, they often bypass email filter detection and appear trustworthy to recipients.

Users, believing they are contacting legitimate support, call the provided fraudulent numbers and provide sensitive information to cybercriminals.

Callback Phishing Attack Via Teams

This campaign represents a mature evolution in callback phishing techniques. Rather than attempting to compromise victims through email links or attachments, attackers rely on voice-based social engineering.

Once victims call the fake support numbers, trained operators can manipulate them into revealing payment card details, account credentials, or other personally identifiable information.

Using Microsoft Teams as the delivery mechanism is particularly effective because many organizations trust internal collaboration platforms.

Grant them liberal email delivery permissions; this trust becomes a liability when attackers exploit it. According to SpiderLabs, researchers have identified the following fraudulent phone numbers associated with this campaign.

Organizations should educate employees about this specific attack pattern. Users should verify urgent payment requests through official company channels rather than responding to Team notifications.

Email security teams should implement additional scrutiny on Teams notifications or adjust delivery policies to require manual approval for Team invitations from unknown groups.

Microsoft Teams users should regularly review their group memberships and be suspicious of groups with financial-themed names, particularly those that use urgency language.

Implementing multi-factor authentication and maintaining robust email gateway security remain essential defenses against such campaigns.

This attack underscores how cyber criminals continuously adapt their techniques to exploit trusted platforms and human psychology rather than technical vulnerabilities.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.