Microsoft Teams Phishing Campaign Lets Attackers Remotely Control PCs

Key Takeaways

• A new phishing campaign leverages Microsoft Teams to trick employees into granting remote access to their Windows PCs.
• Attackers impersonate IT support and guide users to enable Windows Quick Assist, allowing for malware installation.
• The campaign utilizes DLL sideloading and WMI to establish a hidden reverse shell, evading detection.
• The threat enables comprehensive reconnaissance, potentially leading to data theft and network intrusion.
• Organizations should implement strict verification protocols for remote support requests and enhance monitoring for suspicious activity.

Cybercriminals are actively exploiting Microsoft Teams to launch sophisticated phishing attacks, impersonating IT support personnel to gain full remote control over victims’ Windows computers. This campaign transforms a seemingly routine support interaction into a direct conduit for malware deployment, granting attackers the ability to operate on a compromised device as if they were physically present.

The attack sequence begins with an external contact initiated via Microsoft Teams. The malicious actor meticulously builds trust with the target before instructing them to open Windows Quick Assist, a legitimate remote assistance utility. Once the user approves the remote session, the attacker can then proceed to download and execute a malicious installer. This method cleverly bypasses the need for exploiting software vulnerabilities or stealing credentials upfront, relying instead on social engineering and the abuse of trusted tools.

Analysts at Unit 42 said in a report that this activity constitutes a “fake help-desk operation” that masterfully combines social engineering, the misuse of remote-control features, and a clandestine command channel. This approach ultimately provides the attackers with interactive access for reconnaissance and paves the way for potential data exfiltration or broader network intrusions. The effectiveness of this campaign stems from its exploitation of commonly used and permitted organizational tools and services.

A convincing message on Teams, coupled with the use of a built-in remote assistance feature and command-and-control traffic routed through legitimate cloud infrastructure, allows the malicious activity to appear less suspicious than traditional malware delivery attempts. This strategy places the critical security decision squarely on the shoulders of an unsuspecting employee.

Hackers Pose as IT Support on Microsoft Teams

In this campaign, the attackers assume the identity of IT technicians, leveraging Teams’ external access capabilities to reach their intended victims. They then direct employees to utilize Quick Assist, a native Windows tool designed for legitimate technical support, requesting approval for a remote session. Similar Teams support call compromises highlight the critical importance of verifying any unexpected remote assistance requests through established, internal communication channels, rather than relying on instructions from the caller themselves.

Upon gaining control, the malicious operator downloads an MSI installer from an attacker-controlled Amazon S3 bucket and executes it using Windows Installer. The installer package often mimics a legitimate update, containing a genuine signed application alongside a malicious supporting file. This technique, known as DLL sideloading, is part of a broader trend of malware delivery through Teams, where attackers exploit the inherent trust in workplace platforms to lower a victim’s guard.

When the legitimate program launches, it inadvertently loads the malicious DLL from its directory instead of the authentic Windows system file. This DLL sideloading technique allows the harmful code to execute under the guise of a digitally signed application. The malicious DLL then establishes an encrypted connection to an AWS API Gateway endpoint, exemplifying how attackers are increasingly concealing command-and-control traffic within ordinary cloud service activity.

Hidden Shell Evades Detection

The sideloaded DLL does not directly provide the attacker with a command prompt. Instead, it utilizes Windows Management Instrumentation (WMI) to initiate a separate reverse-shell program. This separation complicates simple process-tree analysis, as the malicious shell is not directly spawned by the signed loader, a tactic also observed in <a href="https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/9aa396e4-6194-4410-89a7-4d68d018b2e5/Hackers-Pose-as-IT-Support-on-Microsoft-Teams-to-Take-Remote-Control-of-Windows-PCs.txt?AWSAccessKeyId=ASIA2F3EMEYE4QZ6JXBO&Signature=4uGDJYHFFGfTlxEGXICoMCSiy%2B8%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEPr%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIEFCfQkUBhDiHWTvmJ7%2BEwrUgAk%2BuTsQjXaF%2Fg508SAuAiEAxhV5EEQV0YEW2sOk9SDKxdxpeHaBVkwO5vhkH1AXSwEq%2FAQIw%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARABGgw2OTk3NTMzMDk3MDUiDLDO320yP5tYU5ZmLirQBJVJIoAdtmRFH%2Bxru2n51rhJhjPdJ2TGhSr%2FVFbyvkKyuIDtXoMha%2Fu%2Bcqy1roCuGMVLDzDq1gxS9rMKe3GOljAh9684r%2B6aBubZoOqYbFKh6C05qrINVpu%2BbgcoaxQWNG%2FRV9kE%2F0bVMaXPQwOQ2iNvgvV7y3M0ISkKsAMxdJtq9kUkXI4f7WEdEvQh76UlGycA%2B0xof2MowLuKRkleeIwov9%2FZa2wXQuS31rCNCoXqu2Pcvtb315Rf4bQLQZvso%2BZ2o7GJFQPJmqwSU2ykJg3y66vfM%2Fe9Ia%2Bj%2FxRo0aGHaRBvpjecmdK7QqTPgisMaZuf1CVbNN%2F0m566Bm1pJW%2BBjPMgisTWTOFAh7IXszJjkR%2Fg8G7UBjHUhDcCmuFH5teR06nQ9zg00TuYOKcj7iY1FoXUqBxeZuZ%2FajO4VrNLBVvJqlU4sGeHTriYP9PkxGKcZqb0rHnJfgSUreTVL6Lz3bfMXX9eNnN5P0AIaFvD1tsnmN9MepuQRnDJhUvyh57kymRG2dvIcM%2FaTvwOtTyeh052k8lnPy2x7w6H0cLWHk68BB0hkDtSIm%2Bti5axF73%2BF4zZN2rELWDF%2BN9B6gO5u1RHwpflLNFHtUs7NWCYqzBGbI%2BbX8dCCN0YnNLv9hqwr7sOrcv1%2BNDWBgQYyA6H8xcboeNfbPSEzkuJZ6mxiEdu2xSBGnCydOL86UfML%2FyRQg3O8x1kGa0F0xNENP5OAWl65806YdipMt4JNB5g3lLPvez3bPR766bjQ9%2FqcLOgQGSIXcf7dt7E0uQB1bAw5trf1AY6mAFL8LpnAnNHKiGaHKped2WIj5PHnY%2FoRZoXdb7icZJhHzoLFf7FYOFORTwAWvP3lK7j%2B67exN7HGqg1q7WAXbKgIrbKPgWIc%2F61tVTeC%2FA8T4AQeZdVaQ%2FqMRd8sfIaYC9jqbOYsSMVkHdKY1%2BMu2WkOKYUicwBy8ZsOPNihptSyuUOLDKCw%2BCsAP86Sh0ZIV1z19e4wRH5IA%3D%3D&Expires=1788345

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.