Threat actors are increasingly abusing Microsoft Teams’ external chat capabilities to impersonate corporate IT help desks. They trick employees into installing malware, granting remote access, and stealing Windows credentials.
These attacks exploit a simple vulnerability: employees tend to distrust suspicious emails but often do not apply the same caution to collaboration platforms like Teams.
Attackers create or control separate Microsoft 365 tenants and adopt display names such as “IT Service Desk” or “Help Desk” to start convincing conversations with targeted users.
Hackers Abuse Microsoft Teams
In documented campaigns, attackers use external access on Teams to contact victims from outside their organizations. At first glance, the chat sender may seem legitimate, often using an email address ending in .onmicrosoft.com and a professional profile picture.
According to Scam Drill, the attack typically culminates in a request that the victim install a purported security utility or approve a remote support session.
One analyzed campaign involved a malicious MSI installer named “PowershellCleaner,” which was hosted on a Microsoft Azure Blob Storage endpoint.
The hosting domain was part of legitimate Microsoft infrastructure, making the file appear trustworthy. Once executed, the malware, known as SynkLoader, utilized a multi-language loader that incorporated Python, PowerShell, C#, and C++ components.
SynkLoader was designed to minimize disk artifacts and evade endpoint detection. It deployed its own Python runtime, loaded modules into memory. It established persistence through a randomly named scheduled task, configured to execute at user logon and again daily.
A particularly concerning module, called PhishLocker, displayed a fake full-screen Windows lock screen. It collected the victim’s username and utilized the device’s authentic lock-screen wallpaper to make the prompt more convincing. When users entered their password to regain access to their workstation, the malware captured the credentials in plaintext.
The stolen password could then facilitate broader enterprise access, especially in environments utilizing single sign-on. SynkLoader also featured reverse-proxy functionality that could route attacker traffic through the compromised endpoint, enabling access to internal services while making connections appear to originate from a trusted corporate device and network.
Other Teams impersonation campaigns have focused on remote access tools rather than malware. Attackers have used Quick Assist to persuade victims to grant interactive control of their devices.
They then performed reconnaissance, moved laterally, and exfiltrated data using legitimate utilities like Rclone. In one lab replication, attackers achieved endpoint control within 21 minutes of the first Teams message.
Organizations can reduce their exposure by replacing Teams’ default setting of “allow all external domains” with an allow-list of known partners, managed service providers, and business contacts. Security teams should also prevent unmanaged Teams accounts from initiating chats, carefully review access from trial tenants, and enable Teams block lists.
Employees should be trained to treat unsolicited Teams messages as suspicious, even when they seem to come from IT. The most effective rule is simple: if IT initiates an unexpected support conversation, end the chat and verify the request through a known phone number or established support channel.
If a suspicious installer has already run, organizations should isolate the device, reset affected credentials from a separate system, revoke sessions and refresh tokens, investigate scheduled-task persistence, and reimage the endpoint instead of attempting a partial cleanup.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
