Hackers Impersonate IT Support on Microsoft Teams to Take Control of Employee PCs

A human-operated intrusion campaign in which attackers abuse Microsoft Teams external collaboration to impersonate internal IT or helpdesk staff, persuade employees to grant remote control of their PCs, and then move toward critical enterprise infrastructure.

The campaign does not exploit a Microsoft Teams vulnerability. Instead, it weaponizes trust in familiar support workflows, combining Teams chats or calls, remote-assistance tools, PowerShell, malicious MSI installers, portable Node.js binaries, and native Windows administration protocols.

The result is a hands-on-keyboard intrusion that can progress from a single employee device to domain controllers and certificate authorities

Attackers initiate contact from an external Microsoft 365 tenant while posing as IT support personnel.

They use urgent lures such as security updates, spam-filter changes, account-verification requests, or alleged account-deactivation warnings to pressure users into accepting a screen-sharing “request control” prompt or sharing a Quick Assist access code.

Microsoft maps the initial access technique to MITRE ATT&CK T1566.003, Spearphishing via Service.

The technique is particularly effective because the interaction occurs in an enterprise collaboration application rather than a conventional phishing email.

In some cases, attackers may supplement the Teams contact with voice phishing, or vishing.

A phone or Teams call lets the operator coach a target through installing software or granting remote access without leaving malicious commands and URLs in chat logs.

Once a victim grants control through a legitimate remote monitoring and management tool or Quick Assist, the operator opens PowerShell and downloads a malicious Windows Installer package from cloud storage.

The MSI is installed silently with msiexec using the /qn switch, preventing the victim from seeing installation prompts.

The installer typically uses benign update-themed names, including “devfix” or “Hotfix.” It stages files in the current user’s LocalAppData folder, including a script-based loader and an encrypted JavaScript implant.

If Node.js is unavailable on the host, the malware retrieves a legitimate portable Node.js runtime from the official distribution site.

This approach gives attackers a signed and trusted JavaScript execution environment while minimizing the need to deploy an obviously malicious custom executable.

Hidden bootstrap code launched through PowerShell, cmd.exe, or WScript decrypts the implant and runs it through Node.js, sometimes from a temporary file and sometimes through standard input.

For persistence, observed MSI packages created an EdgeUpdate entry in either the HKEY_CURRENT_USERRun registry key or the user Startup folder.

The persistence mechanism launches Node.js and the staged loader whenever the user signs in.

Microsoft Threat Intelligence observed that, Teams presents external-tenant labels, Accept or Block prompts, message previews, and phishing indicators, but the campaign depends on the victim voluntarily overriding those warnings.

The implant communicates with command-and-control infrastructure through randomized HTTPS long polling.

IT Support on Microsoft Teams

C2 responses are treated as JavaScript and dynamically executed, giving operators access to process execution, filesystem activity, environment variables, and Node.js modules.

Microsoft observed the attackers collecting host, disk, locale, hardware, antivirus, and virtualization details.

The implant also captures screenshots, resizes and Base64-encodes the images, and exfiltrates them through temporary files.

One recovered variant contained disabled logic for discovering an updated C2 address from an Ethereum smart contract, though the analyzed builds relied on a hard-coded fallback server.

After validating the foothold, operators enumerate Active Directory accounts, users, servers, and user-description fields using native commands and ADSI queries.

They also use rundll32.exe to execute attacker-provided DLLs, blending follow-on payload execution into normal Windows activity.

The most serious stage is lateral movement. The Node.js backdoor initiates Windows Remote Management connections over TCP port 5985 to domain-joined systems, including file servers, databases, application servers, domain controllers, and certificate authorities.

WinRM launched from a user-context process is a high-value detection signal because it suggests credential-backed remote execution from a compromised endpoint.

Organizations should treat unsolicited external Teams messages or calls claiming to be IT support as suspicious and require employees to verify requests using a known internal channel.

Teams external collaboration should be restricted to approved domains wherever possible.

Security teams should also monitor remote-support sessions followed by PowerShell, cmd.exe, WScript, or msiexec.exe; Node.js executing scripts from LocalAppData; creation of EdgeUpdate Run-key or Startup-folder persistence; and WinRM traffic from ordinary user workstations.

Restricting WinRM to authorized management hosts, governing RMM tools, enforcing phishing-resistant MFA and Conditional Access, and enabling endpoint protections can reduce the opportunity for attackers to transform a deceptive Teams chat into enterprise-wide compromise.

Microsoft advises organizations that identify indicators of this activity to assume network-level access was obtained and rotate credentials reachable from the compromised machine.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.