Microsoft Teams’ “Chat with Anyone” Feature Sparks Security Concerns Related to Phishing Threats

Microsoft is set to launch an update for Teams, rolling out targeted releases by early November 2025 and expected to reach a global audience by January 2026. This new feature enables users to initiate chats using only an email address, allowing for communication with recipients who do not have Teams accounts. While intended to foster collaboration, this functionality raises significant security alarms among cybersecurity experts.

The capability permits external participants to engage in Teams conversations as guests through email invitations, making communication seamless across various platforms including Android, iOS, desktop, Linux, and macOS. This ease of access, however, significantly broadens the attack surface for malicious actors looking to exploit organizational networks.

One of the primary concerns relates to the accessibility of this feature, which lacks stringent validation and verification processes before allowing chat initiations with external email addresses. This creates a substantial attack vector for cybercriminals. Phishing actors could easily send spoofed invites appearing to originate from legitimate business contacts, tricking users into clicking on malicious links or revealing sensitive information.

A plausible attack scenario could involve cybercriminals sending fraudulent chat requests that seem to come from genuine business partners. Such invitations might contain malware designed to leverage the guest join capability, thereby introducing ransomware or spyware into corporate chat environments. This mirrors tactics employed in OAuth phishing campaigns, where attackers impersonate trusted services to collect credentials and sensitive data.

Data Exposure and Compliance Risks

Microsoft asserts that chats remain under the governance of Entra B2B Guest policies, aiming to keep interactions within set organizational boundaries. However, the risk of accidental data exposure remains pronounced. Employees may inadvertently share proprietary information with impostors, leading to intellectual property theft or violations of regulations such as GDPR.

This risk escalates in hybrid work environments where communication with external contacts is commonplace. For instance, if a sales department engages with a compromised or malicious prospective client via an email-based Teams invite, attackers could gain unauthorized access to sensitive conversations and escalate their privileges to gather even more confidential information.

Furthermore, these guest participants could unwittingly distribute malware-laden files within the Teams framework, circumventing traditional email security filters and endpoint protection measures. The ease with which malware can be circulated within these collaborations amplifies the threat posed to organizational cybersecurity.

Mitigations

In light of these vulnerabilities, Microsoft has acknowledged the security implications tied to this change. The company has urged organizations to review internal documentation and provide training for support teams accordingly. However, the default activation of this feature may lead many organizations to overlook it until they encounter security incidents, similar to oversight scenarios seen in incidents like the SolarWinds breach, where unpatched features led to widespread compromise.