Critical Microsoft Teams, Quick Assist Flaws Let Attackers Impersonate Helpdesk

Key Takeaways

• Attackers are exploiting Microsoft Teams and Quick Assist in sophisticated helpdesk impersonation campaigns.
• The attack chain leverages social engineering to gain remote access, followed by DLL side-loading for persistence and data exfiltration.
• This human-operated intrusion playbook is difficult to detect due to its reliance on legitimate tools and blending into routine IT activities.
• No specific CVEs were mentioned, as the attack primarily exploits human trust and legitimate functionalities rather than software vulnerabilities.
• Microsoft Defender Security Research analysts identified this intrusion playbook and provided mitigation strategies.

A sophisticated new attack campaign is exploiting trusted Microsoft tools, Teams and Quick Assist, to enable attackers to impersonate internal IT support and gain full remote control over employee devices. This deceptive strategy allows threat actors to bypass traditional security measures by leveraging familiar business applications and human trust, according to findings from Microsoft Defender Security Research.

The Deceptive Attack Chain

The campaign initiates with a seemingly innocuous message on Microsoft Teams. An attacker, operating from an external Microsoft tenant, contacts a target employee, falsely identifying themselves as internal IT support. This approach capitalizes on the user’s familiarity with the Teams platform, often leading them to lower their guard compared to an unsolicited email.

Once initial contact is established, the attacker manipulates the victim into disregarding Microsoft’s built-in external contact warnings. The crucial next step involves convincing the employee to approve a remote assistance session via Microsoft Quick Assist. This action grants the attacker complete interactive control over the victim’s device, typically within a minute.

Microsoft Defender Security Research analysts, who detailed this intrusion playbook, emphasized that this attack is predominantly human-operated, relying on social engineering rather than traditional software exploits. The seamless integration with everyday IT operations makes detection particularly challenging without robust event correlation across identity, endpoint, and collaboration telemetry.

Post-Compromise Activities and Persistence

Upon gaining remote access through Quick Assist, attackers act swiftly. Within 30 to 120 seconds, they execute rapid reconnaissance commands to ascertain user privileges, collect host specifics, and evaluate network connectivity. If the compromised system possesses sufficient access, the attacker proceeds to deploy a staged payload into directories such as ProgramData.

A key element of persistence and evasion in this campaign is DLL side-loading. Attackers use this technique to run malicious code through trusted, digitally signed applications. Tools like AcroServicesUpdater2_x64.exe, ADNotificationManager.exe, and DlpUserAgent.exe have been observed loading attacker-supplied modules from non-standard paths, allowing the malicious code to execute under the guise of a legitimate application.

The impact of these intrusions can be severe. Attackers leverage Windows Remote Management (WinRM) for lateral movement towards high-value targets, including domain controllers. Furthermore, they utilize file-sync tools such as Rclone to exfiltrate sensitive business documents to external cloud storage, demonstrating a clear intent for data theft.

How DLL Side-Loading Enables Persistent Control

DLL side-loading is a critical infection mechanism in this campaign. It exploits the Windows operating system’s method for loading application support libraries. When a legitimate, digitally signed application initiates, Windows searches for its necessary DLL files in predefined folder locations. Attackers strategically place their own malicious DLLs in these same paths, tricking the trusted application into inadvertently loading and executing the attacker’s code instead of the legitimate one.

In this particular campaign, the sideloaded modules serve as intermediary loaders. Instead of writing suspicious data to disk, they decrypt hidden configuration data stored within the Windows registry. This behavior is consistent with advanced intrusion frameworks like Havoc, which use registry-backed storage to maintain encrypted command-and-control (C2) configurations across reboots and to resist remediation efforts. Because this malicious activity operates within a trusted, vendor-signed process, conventional security tools often struggle to identify it as a threat.

Once the C2 channel is established, the compromised process initiates encrypted outbound HTTPS traffic over TCP port 443 to attacker-controlled cloud infrastructure. This traffic blends seamlessly with regular business network activity, further aiding evasion. Attackers also install additional remote management software to establish a secondary access channel and leverage WinRM sessions to move laterally across the network, targeting identity systems for broader compromise.

What You Should Do

• Treat all unsolicited external Teams messages, especially those claiming to be from IT support, with extreme suspicion. Always verify such requests through established internal channels.
• Implement strict controls on remote assistance tools like Quick Assist, restricting their use to only authorized IT personnel and specific, monitored scenarios.
• Enable Attack Surface Reduction (ASR) rules and Windows Defender Application Control (WDAC) to prevent DLL sideloading from user-writable locations such as ProgramData and AppData.
• Enforce Conditional Access policies that mandate multi-factor authentication (MFA) and compliant devices for all administrative and sensitive sessions.
• Activate Safe Links for Microsoft Teams and Zero-hour Auto Purge (ZAP) to proactively and retroactively detect and quarantine malicious messages.
• Restrict Windows Remote Management (WinRM) to designated, secure management workstations and continuously monitor for the presence or use of unauthorized data-sync tools like Rclone within your environment.
• Conduct regular cybersecurity awareness training for employees, focusing on identifying external tenant indicators in Teams and establishing a clear, verbal authentication phrase for legitimate helpdesk interactions.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.