The demise of Skype and people switching to Microsoft Teams is producing a new wave of socially-engineered malicious activity using spoofed email meeting requests, some with attachments.

Now that Skype has Skype has been retired by Microsoft, people who once used the voice and video platform for meetings have been told to switch to Microsoft Teams.  So instead of seeing a message notification in Skype, it is now much more common to see in your inbox a calendar notification email with time blocked out tentatively on your calendar.  Because meetings often require associated subject matter for the meeting, attachments and links are also quite typical. 

It is both this increased frequency post-Skype, and the normality of having attachments for meetings that make them an ideal vector for malicious activity - something that is being exploited as the switchover from Skype happens. 

Because these attacks start from your inbox, they also lend themselves to spoofing.  In the attack highlighted in this post, the Meeting Request email is from 'Microsoft Billing Support'.  The subject line is Action Required: We couldn't process your Microsoft subscription.  'Action required' emails and others calling for an urgent response are a common approach used by malicious actors, usually calling for action - like clicking on a link, or opening an attachment that ostensibly 'verifies' why you need to take action.

Examining the Microsoft Billing Support email, it is apparent that it is from a compromised domain and not from Microsoft.  But if you had gone to your calendar, you'd have seen the spoofed email, not the actual email address. And for those of you who report these types of domains, you'll see the Deceptive site ahead warning as shown in the header of this article. In this instance, it was from the site s4.tsacademyplus.co.im/.

What to do: 

If you are checking either you inbox or calendar and see a new calendar meeting request from someone you don't recognise, be wary.  But perhaps even more insidiously, the most common instances of compromised systems come from socially engineered emails - these are emails that you 'recognise', so you let your guard down.  Be doubly aware of meeting requests that you didn't initiate, agree to, weren't expecting, or where the meeting is about something that could be resolved in some other way - a quick text, message, or email. As with standard online good hygiene, be particularly aware of attachments.  When you get an unexpected Microsoft Teams Meeting email, switch your default reaction to sceptical and treat it as malware.  If it's from a vendor with which you have dealings, check on their site first, or follow up up via a different method to validate the request without clicking. 

If it's from a stranger or an unknown source, my recommendation would be to mark the email as junk.

Take care with Microsoft Teams Invites so that you don't get a nasty surprise.