CriticalPhishing
Hackers Using Microsoft Teams Messages and Calls to Trick Users and Gain Remote Access to System
Cyber Security News·Source published ·1 min read
What happened?
Hackers are using Microsoft Teams messages and voice calls to impersonate IT support staff, persuade employees to approve remote access, and move deeper into corporate networks. Two intrusions investigated by Microsoft show how a seemingly routine help desk conversation can lead to stolen data and access to highly privileged accounts. The attacks did not exploit a Microsoft Teams vulnerability. Instead, they combined social engineering, legitimate remote-support software, and weak Active Directory Certificate Services configurations.
Key details
- Hackers impersonate IT support via Microsoft Teams messages and calls to trick users into granting remote access.
- Attackers executed portable Python, Bun, or Java runtimes to run attacker-controlled code after gaining remote access.
- Attackers copied files to an external SFTP destination using a renamed Rclone utility after obtaining a privileged account.
Fixes and mitigations
- Restrict external Teams access and unapproved remote-support tools.
- Revoke unauthorized certificates and separately review Kerberos tickets; resetting passwords alone does not remove certificate-backed access.
What to look for
- SHA-256 hash 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17 identified as initial-access JavaScript.
- SHA-256 hash f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001 identified as initial-access Python script.
- SHA-256 hash 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7 identified as initial-access Python script.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.