Microsoft Teams Phishing Attacks Steal Windows Credentials

Key Takeaways

• Cybercriminals are leveraging Microsoft Teams’ external chat functionality to impersonate IT support and launch sophisticated phishing attacks.
• These campaigns trick employees into installing malware, granting remote access, or divulging Windows credentials via convincing fake lock screens.
• The attacks exploit social engineering rather than software vulnerabilities, relying on user trust in seemingly legitimate internal communications.
• A specific malware, SynkLoader, has been observed delivering a credential-harvesting module called PhishLocker through these Teams phishing attempts.
• Organizations should implement stricter controls on Teams external access and educate employees on verifying unsolicited IT support requests.

Microsoft Teams Exploited in Advanced Phishing Campaigns Targeting Windows Credentials

In a concerning trend, threat actors are actively exploiting Microsoft Teams’ communication features to conduct highly effective phishing attacks, impersonating internal IT help desk staff to compromise employee credentials and systems. These campaigns bypass traditional vulnerability exploitation, instead relying heavily on social engineering to trick unsuspecting users.

Impersonation and Initial Compromise via External Chat

Attackers initiate these sophisticated phishing operations from their own controlled Microsoft 365 tenants. They craft deceptive display names such as “IT Service Desk” or “Help Desk” to appear legitimate, then contact employees directly through Teams’ external chat function. By default, Teams permits communication with external domains, enabling attackers to reach users in other organizations’ Microsoft 365 environments, provided external access is enabled on both sides.

The initial message often presents an urgent scenario, such as a critical security issue, device cleaning requirement, email problem resolution, or the need for an immediate software update. The attacker then guides the employee to perform an action, which might include downloading a malicious file, approving remote screen control, opening the Quick Assist application, or providing a remote-support code.

Microsoft has previously issued warnings regarding threat actors utilizing this cross-tenant impersonation technique specifically to persuade employees into approving interactive remote sessions. Once remote access is established, attackers gain significant control, allowing them to execute arbitrary commands, install additional malware, map Active Directory systems, move laterally within the network, and exfiltrate sensitive data.

SynkLoader and PhishLocker: The Fake Lock Screen Tactic

A notable recent campaign has involved the distribution of a malware family identified as SynkLoader. Researchers discovered that this malware was delivered via a Microsoft Teams phishing message, meticulously designed to mimic a legitimate IT support request. The victim was successfully convinced to download and install a malicious MSI file, which was reportedly hosted on Microsoft Azure storage. The use of a Microsoft-hosted location for the malicious payload lends an additional layer of perceived legitimacy, making the download appear more trustworthy to an unsuspecting employee.

Following installation, SynkLoader primarily operates in memory and establishes persistence through scheduled tasks. A critical component identified within SynkLoader is a module named PhishLocker. This module is responsible for displaying a highly convincing fake Windows lock screen, designed to mirror the authentic Windows login interface. The malware can even populate the user’s account name and display a familiar Windows background image, further enhancing the illusion of legitimacy.

When an employee attempts to “unlock” their computer by entering their password into this fake screen, PhishLocker captures the credentials in plaintext. This method negates the need for attackers to crack password hashes or bypass the login process entirely; their objective is simply to harvest the password as the user types it.

According to ScamDrill, a key method for users to potentially identify a fake lock screen is by pressing Ctrl+Alt+Delete. A genuine Windows lock screen will open the Windows Security screen, a behavior that standard full-screen applications cannot replicate. Users can also attempt to use Alt+Tab. In the SynkLoader case, the fake lock screen presented as a borderless full-screen window, which allowed the task switcher to still appear over it, offering another potential indicator of compromise.

The Evolving Threat Landscape in Collaboration Platforms

These campaigns underscore a growing social engineering risk inherent in modern collaboration platforms. While employees are often trained to exercise caution with suspicious emails, they may exhibit less vigilance when receiving what appears to be a live Teams message from an internal IT support contact. The real-time, conversational nature of Teams can create a false sense of security and urgency.

What You Should Do

• Restrict External Access: Configure Microsoft Teams to limit external access to only known and trusted domains, rather than allowing communication with all external domains by default.
• Enable External Sender Indicators: Ensure that your Teams settings are configured to clearly display indicators for external senders, making it easier for users to distinguish internal communications from external ones.
• Implement Verification Protocols: Establish and enforce a strict policy requiring employees to independently verify any unsolicited IT support requests received through Teams. This verification should occur via a known, trusted internal channel such as a dedicated service portal, a pre-established phone number, or an in-person confirmation.
• Employee Training: Conduct regular security awareness training emphasizing the risks of social engineering attacks via collaboration platforms. Train employees never to install software, share remote-access codes, approve screen control, or enter passwords into unexpected lock screens without independent verification.
• “If in doubt, log out and call”: Advise employees that if IT contacts them unexpectedly via Teams, they should end the chat immediately and use a pre-approved, trusted method (e.g., calling the IT help desk number directly) to confirm the legitimacy of the request.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.