Most Popular 2026 Detection — External/Guest Tenant Microsoft Teams Call Imperso

Ibrahim Saud@tektrix

•updated 12 days ago•0•0•1

Detects a suspicious pattern where an inbound Microsoft Teams call or chat from an untrusted external guest tenant is followed within 30 minutes by a credential, MFA, or account-recovery action on the target user's account in Entra ID. This behavior is indicative of a vishing-over-Teams attack where an adversary impersonates IT support to facilitate unauthorized account recovery or MFA bypass.