TeamsPhisher Tool Exploits Microsoft Teams to Deploy Malware

How did the tool come into existence?

• Last month, two researchers at Jumpsec highlighted the issue by explaining that attackers could bypass a security feature in Microsoft Teams. 
• The feat could be achieved by changing the internal and external recipient ID in the POST request of a message, thus tricking the system into treating an external user as an internal one.  
• As the issue remained unresolved, a member of the U.S. Navy’s red team lately published the TeamsPhisher exploit tool that would leverage the flaw. 

Modus operandi

• TeamsPhisher is a Python-based tool that provides a fully automated attack.
• The tool first checks a Teams user and verifies that the user can receive external messages.
• It then creates a new thread with the target user and sends a message with a Sharepoint attachment link.  
• This new thread appears in the sender’s Teams interface for manual interaction, ultimately initiating the attack.

Conclusion