No matter the reason for the delay the flaw is there and could be open to attackers for the foreseeable future. A red team member for the US Navy thought it would be a good time to create a handy tool to streamline the attack since it will be there for a while. The tool is called TeamsPhisher and has been written in Python. TeamsPhisher allows you to fully automate the attack. All you have to do is give it the payload and a list of Teams users to send it to. The tool will verify that the users are valid, then create the thread with SharePoint link to your payload. There is even a preview mode to help verify the list of targets. It is quite the tool with optional features to allow rate limit bypass, sending secure links so that only the intended target can view or open the file and more. You will need a valid Microsoft Business account that includes SharePoint and Teams, but that should not be difficult for an attacker to get access to. After all Business Email Compromise is still one of the leading attacks, it would be very easy to not only send out the next round of phishing emails, but also leverage Teams to gain access to the next target.

As we mentioned in our previous coverage, there are ways to block this attack. Cutting off external access is one good way as then the external connection cannot be made. If you must connect to external domains, limit the connection to only those that are trusted and manually allowed to make the connection. Adjusting EDR solutions to prevent a pivot from an Office Application (creating a sub-process) can also be effective here.

Still in the end, Microsoft must fix this and stop treating it as if this is not a serious security issue in an application that they push heavily onto not only businesses, but also onto consumers. As there is now a tool available to attackers that allows for automation of this attack, maybe, just maybe, Microsoft will devote some engineering time to fix this so companies are not wide open to this attack vector. Microsoft does have the talent and capability to remediate this flaw and they could do it quickly. However, this is Microsoft so who knows what they might do. Until we there is a patch in place for this, we recommend making users of Teams aware of the risks involved with Teams and also adjusting your existing settings to either block external connections or limit who can connect.