Microsoft Teams is getting a suite new AI features to crack down on phishing attacks
A sharp rise in phishing attacks against Microsoft Teams has prompted a raft of new features
Microsoft Teams will soon use AI to watch for phishing and other scams, the company has revealed.
In a post detailing new features on the roadmap earlier this month, the company said AI-powered anti-phishing tools will arrive in November. The new features follow a series of attacks in which Teams has been targeted by hackers to spread ransomware or otherwise gain access to company networks.
The aim, Microsoft said, is to use AI to better understand messaging conversations in Teams, in particular "first contact chats" with an outsider.
"Microsoft Teams is introducing AI-powered phishing detection that uses conversation context to identify phishing and social engineering in higher-risk messaging scenarios, primarily external first-contact chats," the post explains.
"Additional protection may apply in certain regions or scenarios," the post continues. "The capability is used only for security protection, and users may see warnings when suspicious activity is detected."
The new phishing detection capabilities will work in the background, spotting phishing, impersonation, and other social engineering techniques by looking for suspicious behavior and other indicators such as dodgy links or files.
Conversation context
The AI-powered tool will use conversation context, Microsoft said — which does mean it needs to look at messages in Teams. However, the tech giant said none of the content will be retained.
"This capability is used only for security protection and not for productivity, summarization, advertising, user monitoring, or other non-security purposes," Microsoft said in a post.
"Customer message content is not retained by the detection system for model training or other secondary uses."
The feature will be enabled automatically, rolling out over November and December, and are part of wider efforts to protect Teams as it increasingly becomes a target for phishing scams.
Rise in Teams phishing
Microsoft Teams has become a popular hunting ground for cyber criminals. Last year, Sophos spotted hackers attempting attacks via Teams by pretending to be tech support workers.
Months later the FBI and other authorities warned about the Scattered Spider hacking group abusing Teams and Slack to target employees.
Read more on the latest phishing trends
In January, Check Point researchers warned Teams users to be on alert for scam guest invitations that attempted to trick users with false billing and subscription notifications that look as though they came from a genuine Microsoft user.
Just this week, Arctic Wolf Labs has spotted hackers using Microsoft Teams' feature that allows for external chat creation for impersonation scams or to send dodgy files, studying more than 400 incidents.
"Microsoft Teams ships with external access (federation) turned on by default, meaning any Teams user in another Microsoft 365 tenant can find, chat with, and call an organization’s employees, provided both tenants allow external access," Arctic Wolf noted in a post.
"This is the feature attackers most frequently abuse. This activity does not exploit any known Teams vulnerability; it abuses a legitimate, default-on collaboration capability."
These are the sorts of "first contact chats" that Microsoft is hoping to address with the new AI feature.
FOLLOW US ON SOCIAL MEDIA
Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.
You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.
-
UK police and fire services urged to bolster cyber capabilitiesNews From legacy systems and poor training to third-party risks, more needs to be done to protect sensitive data
-
Previder enters UK market with Wanstor acquisitionNews The move extends the Dutch MSP’s presence across North-West Europe as part of its ongoing international expansion strategy
-
Nearly half of CISOs have been hit by AI deepfake voice calls – here's how to spot the tell-tale signs you're being scammedNews Gartner has urged CISOs to remain vigilant for voice and video social engineering attacks
-
Microsoft takes down ‘EvilTokens’ hacker service that used AI to ‘decide who to target, who to impersonate, and how to most effectively exploit’ victimsNews In just six months, the EvilTokens phishing as a service platform hit thousands of organizations worldwide
-
Cyber criminals are adapting ASCII smuggling for mass phishing campaignsNews Usually known for its use in prompt injection attacks, ASCII smuggling is now being used to evade spam filters on email platforms
-
Be careful who you talk to at conferences: Security researchers claim they were targeted by cyber criminals after DEF CON event
News Scammers contacted conference attendees with a booby-trapped Google Doc designed to look like a routine post-event contact
-
Delta Airlines flight Wi-Fi tampered with after DEF CON conferenceNews A rogue network named 'Delta WiFi Fast' was created in an apparent in-flight phishing attack
-
NCSC issues alert over 'zero-click' phishing campaign hitting enterprisesNews Ukrainian organizations were used to test new zero-click techniques employed by Russian hackers
-
Multi-channel phishing attacks: How to manage the riskIn-depth Attackers are evolving beyond email towards phishing across multiple channels. Why is this, and what can be done to manage the risk?
-
Hackers are posing as Interpol to target small businesses – here's what you need to knowNews Small businesses are warned to think twice before clicking on links
