WISHING: WEBHOOKS PHISHING IN TEAMS

Summary from the TLDR InfoSec newsletter

This article presents a rundown of methods to phish users via Microsoft Teams. By default, any user can install a new Incoming Webhook - Microsoft provides no way to add authentication to webhooks. An attacker can leverage this to send phishing messages to channels that look like legitimate messages from connected applications. Teams also supports a channel email feature which enables the same capabilities via a unique email address per channel.