Microsoft Teams guest access can let hackers bypass some critical security protections

• Microsoft Teams guest chat feature creates unprotected attack vector for malware and phishing
• Guests rely on the host’s security, which allows malicious actors to bypass usual protections
• Companies are advised to limit external invitations, disable chats and educate staff on phishing risks

A new feature recently added to Microsoft Teams has also introduced a “fundamental architectural gap” – a vulnerability that could be exploited to drop malware, share phishing links and more – all without triggering the usual security alerts, experts have warned.

Cybersecurity researchers Ontinue found that the guest access feature in Microsoft Teams creates an unprotected attack vector.