Teams cyber threats

There is currently a growing trend of cybercriminals using Microsoft Teams chats to launch sophisticated social engineering attacks against higher education institutions.

The goal of these attacks is to steal your credentials or encrypt your data with ransomware. The attackers pretend to be either official representatives or technical support and security staff, and they use persuasive language and fake links to lure you into their trap.

What can I do to keep safe?

• Be wary of communications in Teams chats with external users.
• Refrain from entering MFA codes sent via an unsolicited message.
• Never share your account information or authorise sign-in requests over chat messages.
• If you see unusual activity on your account which was not you, use the 'This wasn’t me' option to block access and change your password promptly. You can view your university sign-in activity by visiting: https://mysignins.microsoft.com/

To ensure the safety of our environment, we recommend the following actions:

• If you receive any suspicious message or request on Teams, do not click on any links or download anything.
• Report it immediately though the 'Report' button in Teams.
• Stay alert and be cautious of any unusual requests, especially from external senders.

Your vigilance is key to keeping our environment safe.

How to identify an external sender and report a Teams message

Identify an external sender by:

• View the name of the sender. Next to their name will be an external label as shown in the image below.

Report a message by:

1. On the message, click the ellipsis (…)
2. Select 'More actions'
3. Select 'Report' this message
4. Click 'Report'