The Help Desk That Wasn't There: How a Teams Message Became Ransomware in Under 17 Hours
Your inbox fills first. Hundreds of messages, all at once. Newsletter confirmations. Subscription receipts. Things you never signed up for, arriving faster than you can delete them. It looks like some
Responses
Markdown supported · ⌘↵ to post
"The domain is the ID" holds, with one wrinkle worth spelling out: for the 30 to 40% of cases on
*.onmicrosoft.com, there's nothing to look up. No registration date, no registrar, just a tenant name. Those are where the allow-listing fix does the work.The other half, the paid
.topand.comdomains, are where registration data earns its keep. A "helpdesk365"-style name registered last week is about as loud a signal as you get. One low-effort way to catch them before they message anyone is to filter a newly registered domains list for words like helpdesk, itsupport or 365 and alert on hits. WhoisFreaks (I work on it) publishes a free daily list on GitHub. It's a partial 10k/day sample, so a hit is a real signal and a miss proves nothing.