Storm-0324, a financially motivated threat group, has recently switched to Microsoft Teams phishing attacks to breach corporate networks. Storm-0324 has deployed Sage and GandCrab ransomware in the past and is also known to have provided the FIN7 cybercrime gang with access to corporate networks in the past. The threat actor’s current campaign involves phishing lures delivered via links to malicious SharePoint-hosted files sent via Microsoft Teams. Storm-0324’s end goal is unknown, but their attacks thus far have been aimed at stealing users’ credentials after targeting them with false multifactor authentication (MFA) prompts. Researchers suspect the threat actors are using a publicly available, open-source tool called TeamsPhisher that allows attackers to bypass restrictions for files sent from external tenants, effectively enabling phishing attachments to be sent to Teams users. The security issue went unnoticed back in July when APT29 was observed exploiting the flaw, but Microsoft has since taken measures to suspend all suspected tenants and accounts used in Storm-0324’s campaign while also making the externality of a user more apparent for Teams users. CTIX analysts advise users of Microsoft Teams to exercise caution when interacting with unknown or potentially malicious senders.