Hackers Impersonate IT Support on Microsoft Teams to Gain Remote Access to Employees’ PCs

Hackers are impersonating IT support staff on Microsoft Teams to persuade employees to grant remote access to their Windows computers.

The activity combines convincing helpdesk identities, unwanted email floods, and legitimate remote support tools, turning an apparently routine workplace conversation into an opportunity to install malware and investigate corporate networks.

The attacks exploit trust rather than a Microsoft Teams vulnerability. External messaging lets attackers approach employees from separate Microsoft 365 environments when both organizations permit communication.

Previously reported fake IT support calls show how inbox flooding creates confusion before an impersonator arrives offering to solve the problem.

Researchers from Arctic Wolf identified a potentially new malware infection chain while investigating this activity.

Their October 26 research report analyzed more than 400 incidents involving Teams external chat abuse, documenting repeated impersonation patterns, remote access software misuse, and infrastructure shared across multiple intrusions.

Hackers Impersonate IT Support on Microsoft Teams

Attackers commonly create or acquire Microsoft 365 tenants and configure identities resembling corporate support accounts.

Between 30% and 40% of the cases examined involved default Microsoft tenant domains. Others used paid domains, with the .top extension accounting for approximately half of the paid-domain identities observed during recent months.

Display names reinforce the deception. Attackers add friendly first names, support titles, company names, or an “Internal” label to make an external account appear trustworthy.

These labels do not change the account’s actual status, but they encourage employees to overlook the platform’s external-user warning and accept an unexpected support request.

In many incidents, the contact follows hundreds of newsletter subscriptions or confirmation emails arriving within minutes. The attacker then offers assistance through chat or a Teams voice call.

This manufactured problem gives the impersonator a believable reason to request screen sharing, remote control, or software installation.

Quick Assist was the most frequently observed remote support tool, alongside AnyDesk, ScreenConnect, TeamViewer, Atera, and others. Earlier Teams vishing backdoor attacks similarly used approved remote sessions to deliver malware.

These legitimate applications are not inherently malicious; the danger comes from granting access to an unverified person. The transition can be fast.

Customers reported payload execution within 15 minutes of engagement, while attackers often contacted several employees within roughly five minutes.

After gaining control, operators sometimes installed another remote management application, creating a separate access channel that could remain available after the initial malware was removed.

Malware Delivery, Detection, and Defensive Measures

In the newly described infection chain, the impersonator instructed an employee to run PowerShell and launch a downloaded installer.

The command retrieved an MSI package from Azure Blob Storage containing a script and compressed archive. Both initial actions ran under the victim’s account, with Windows Explorer recorded as their parent process.

About 30 seconds after installation, a bundled script executed from the user’s local application data directory. It decoded hexadecimal content and decrypted another PowerShell stage using an embedded AES key and initialization vector.

A hash comparison checked the decrypted content before execution through a PowerShell ScriptBlock. The next stage extracted a Python interpreter and implant, then launched the implant after a five-second delay.

It initiated another MSI transaction and queried Active Directory for computer and user objects. Collected account names and descriptions were sent to command-and-control endpoints randomly selected from destinations embedded in the code.

Arctic Wolf identifies the initial ChatCreated event as an early detection opportunity. However, defenders should correlate it with email flooding, remote tool launches, PowerShell activity, and identity alerts.

Related Teams attack investigation guidance highlights audit-log visibility limitations, making endpoint evidence important when reconstructing how an employee interaction became a compromise.

Organizations should follow Microsoft’s external access guidance and allow only trusted partner domains where practical.

Restrict unnecessary remote support applications, investigate unexpected installations, and require employees to verify unsolicited assistance through a known helpdesk number or service portal. A familiar chat interface is not proof that the sender belongs to internal IT.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Impersonate IT Support on Microsoft Teams to Gain Remote Access to Employees’ PCs appeared first on Cyber Security News.