Microsoft Teams will soon use AI to watch for phishing and other scams, the company has revealed.

In a post detailing new features on the roadmap earlier this month, the company said AI-powered anti-phishing tools will arrive in November. The new features follow a series of attacks in which Teams has been targeted by hackers to spread ransomware or otherwise gain access to company networks.

The aim, Microsoft said, is to use AI to better understand messaging conversations in Teams, in particular “first contact chats” with an outsider.

“Microsoft Teams is introducing AI-powered phishing detection that uses conversation context to identify phishing and social engineering in higher-risk messaging scenarios, primarily external first-contact chats,” the post explains.

“Additional protection may apply in certain regions or scenarios,” the post continues. “The capability is used only for security protection, and users may see warnings when suspicious activity is detected.”

The new phishing detection capabilities will work in the background, spotting phishing, impersonation, and other social engineering techniques by looking for suspicious behavior and other indicators such as dodgy links or files.

Conversation context

The AI-powered tool will use conversation context, Microsoft said — which does mean it needs to look at messages in Teams. However, the tech giant said none of the content will be retained.

“This capability is used only for security protection and not for productivity, summarization, advertising, user monitoring, or other non-security purposes,” Microsoft said in a post.

“Customer message content is not retained by the detection system for model training or other secondary uses.”

The feature will be enabled automatically, rolling out over November and December, and are part of wider efforts to protect Teams as it increasingly becomes a target for phishing scams.

Rise in Teams phishing

Microsoft Teams has become a popular hunting ground for cyber criminals. Last year, Sophos spotted hackers attempting attacks via Teams by pretending to be tech support workers.

Months later the FBI and other authorities warned about the Scattered Spider hacking group abusing Teams and Slack to target employees.

In January, Check Point researchers warned Teams users to be on alert for scam guest invitations that attempted to trick users with false billing and subscription notifications that look as though they came from a genuine Microsoft user.

Just this week, Arctic Wolf Labs has spotted hackers using Microsoft Teams’ feature that allows for external chat creation for impersonation scams or to send dodgy files, studying more than 400 incidents.

“Microsoft Teams ships with external access (federation) turned on by default, meaning any Teams user in another Microsoft 365 tenant can find, chat with, and call an organization’s employees, provided both tenants allow external access,” Arctic Wolf noted in a post.

“This is the feature attackers most frequently abuse. This activity does not exploit any known Teams vulnerability; it abuses a legitimate, default-on collaboration capability.”

These are the sorts of “first contact chats” that Microsoft is hoping to address with the new AI feature.

FOLLOW US ON SOCIAL MEDIA