Microsoft has disclosed a campaign in which attackers impersonate internal IT staff on Microsoft Teams and persuade employees to grant remote access. From that user-approved session, the attackers can move toward high-value identity systems, including domain controllers and certificate authorities.
The attack starts from a separate Teams tenant. The operator contacts an employee by chat or call and asks the user to approve a screen-share “request control” prompt or open Quick Assist and use a connection code.
The disclosure said the activity does not exploit a Teams vulnerability. It depends on users overriding external-contact warnings and approving legitimate remote-support tools.
Malware follows remote access
Once inside the device, the attacker uses PowerShell to download and silently install a malicious Windows Installer package. Microsoft observed update-themed names including “devfix” and “Hotfix.”
The package stages a portable Node.js runtime and an encrypted JavaScript implant. The loader decrypts the implant before it communicates with the command-and-control server over HTTPS.
The operator can then use tools already present or expected in Windows environments for follow-on activity, including PowerShell, WScript, rundll32 and Windows Remote Management (WinRM).
Microsoft said that reliance on legitimate collaboration, support and administrative tools can make the activity resemble normal enterprise operations at several stages of the intrusion.
Attackers move across the network
The operator then maps the compromised environment. The attackers survey the compromised network, taking periodic screenshots and using Windows tools to identify domain accounts, users and servers.
Follow-on tasking used WinRM over TCP port 5985 to connect to domain-joined systems, including domain controllers and certificate authorities.
Access can lead to wider compromise
That sequence puts the employee-approved remote session at the start of the compromise. Microsoft Teams uses trust indicators for people outside an organization, and Microsoft said the service also presents Accept or Block prompts, message previews and phishing indicators at first external contact.
The attack chain depends on persuading the employee to move past those warnings and hand over interactive control.
Microsoft described the resulting access as credential-backed and said the observed reconnaissance and WinRM movement are consistent with activity that can precede data theft, extortion or ransomware deployment.
Mitigation starts with verifying support requests
Microsoft recommends treating unsolicited external IT-support contact as suspicious and verifying it through a known internal channel before granting remote access. It also advises restricting Teams external access to trusted domains, requiring device- or identity-based checks for remote-support sessions and limiting WinRM to authorized management workstations.
The company also recommends attack surface reduction rules to restrict risky executable and scripting behavior, along with tighter controls on remote monitoring and management software.
If defenders find signs of the attack, Microsoft says they should change credentials that may have been exposed on the affected device, including domain administrator credentials if the device was connected to the company’s Windows domain.