Unlike standard commodity malware that aims for quick credential theft, this campaign features a manual, hands-on-keyboard scheme designed to escalate rapidly from a single compromised workstation to broad, network-wide access.
Microsoft Security Research has identified a comprehensive, human-operated intrusion campaign that weaponizes Microsoft Teams to bypass traditional phishing defenses. Threat actors are actively impersonating internal IT and helpdesk personnel to deceive employees, ultimately leveraging these social engineering tactics to establish persistent, high-level control over enterprise environments.
Unlike standard commodity malware that aims for quick credential theft, this campaign features a manual, hands-on-keyboard scheme designed to escalate rapidly from a single compromised workstation to broad, network-wide access.
The attack chain begins when an attacker, operating from an external tenant, initiates a Teams call or chat while posing as internal technical support. By convincing the user to bypass standard warnings, the threat actor coerces the victim into granting an interactive remote support session. Once the operator gains control via legitimate remote-assistance tools, they use PowerShell to silently install a malicious MSI package.
A critical component of this campaign is its strategic reliance on trusted binaries to evade detection. The installer deploys a portable Node.js runtime, which in turn executes an obfuscated JavaScript implant. By utilizing legitimate, signed runtimes and native Windows administrative protocols, the threat actor ensures the malicious activity blends seamlessly into the standard operational noise of a corporate network.
These types of campaigns are reminiscent of the kind of activities North Korean threat actors favor, particularly the fake help desk/IT tactic.
“Because interaction occurs within an enterprise collaboration platform rather than through traditional email, it could bypass the initial skepticism associated with unsolicited external communication. The lure varies, for example “Microsoft Security Update,” “Spam Filter Update,” “Account Verification,” or tasks required to stop deactivation of an account, but the objective is consistent: convince the user to ignore external-contact flags, launch a remote management session, and accept elevation. Voice phishing (vishing) is sometimes layered to increase trust or compliance, or so malicious instructions or URLs never enter the chat logs,” the Microsoft Security Research team said.
Once persistence is established, the operator initiates a comprehensive reconnaissance phase. Using a mix of native commands and Active Directory Service Interfaces (ADSI), the attackers map the domain, enumerate sensitive accounts, and identify high-value targets. The campaign’s ultimate objective often manifests as lateral movement via Windows Remote Management (WinRM) over TCP port 5985.
Researchers observed the attackers pivoting from the initial foothold toward critical infrastructure, including domain controllers and certificate authorities, positioning themselves for big results such as mass data exfiltration, IP theft, or the deployment of ransomware.
This campaign is part of a shift in threat actor tactics, prioritizing the abuse of legitimate collaboration workflows over direct platform exploitation. Because the intrusion relies on credential-backed interactivity, traditional endpoint detection may miss the initial steps of the compromise. Organizations are encouraged to adopt a hardened stance on external collaboration by restricting Teams external access to verified domains and implementing strict monitoring of remote support sessions.
These types of campaigns are reminiscent of the kind of activities North Korean threat actors favor, particularly the fake help desk/IT tactic.
Defenders should prioritize identity-based access controls and restrict administrative protocols—specifically WinRM—to known, authorized management workstations. Continuous monitoring for PowerShell process execution and anomalous WinRM traffic remains essential for disrupting these campaigns before they can reach domain-critical systems.
