Fake IT technicians on Microsoft Teams: how hackers target companies
Microsoft detects a cyberattack campaign where criminals pose as technical support through Teams external collaboration.
Microsoft Threat Intelligence has identified a human-operated intrusion campaign that exploits Microsoft Teams external collaboration. The malicious actors use social engineering techniques to impersonate IT technical support, thereby succeeding in gaining remote access to corporate systems.
Once contact is established, the attackers install a Node.js-based implant. From this starting point, the cybercriminals manage to move laterally within the corporate network using legitimate tools, turning a single remote session into widespread access across the entire enterprise.
To counter this threat, Microsoft Defender proves to be a fundamental tool. Indeed, the security service helps to promptly detect and disrupt malicious activities, blocking the attackers' actions before they can compromise the entire infrastructure.