Cybercriminals are posing as IT technicians on Microsoft Teams and persuading employees to hand over control of their Windows computers.

The campaign turns a familiar support conversation into a direct path for installing malware, leaving the intruder able to work on the victim’s device as if sitting in front of it.

The attack begins through external Teams contact, where an operator builds trust and asks the target to open Windows Quick Assist.

Once the user approves the session, the attacker can download and launch a harmful installer, bypassing the need to exploit a software flaw or steal a password first.

Unit 42 analysts identified the activity as a fake help-desk operation that combines social engineering, remote-control abuse and a hidden command channel.

Unit 42 said in a report shared with Cyber Security News (CSN) that the method ultimately gives operators interactive access for reconnaissance and possible follow-on theft or network intrusion. The campaign matters because it abuses tools and services many organizations already allow.

A convincing Teams message, a built-in remote assistance feature and traffic routed through cloud infrastructure can make the activity look less suspicious than a conventional malware delivery attempt, while placing a critical security decision in the hands of one employee.

Hackers Pose as IT Support on Microsoft Teams

The callers impersonate an IT technician and use Teams external access to reach targets. They direct the employee to Quick Assist, a native Windows utility intended for legitimate support, and seek approval for a remote session.

Similar Teams support call compromises show why an unexpected request for remote help must be verified through a known internal channel, not through the caller’s instructions.

After gaining control, the operator retrieves an MSI installer from an attacker-controlled Amazon S3 location and runs it with Windows Installer.

The package can use a name that resembles a routine update, then places a legitimate signed application alongside a harmful supporting file. This approach is part of a wider pattern of malware delivery through Teams, where trusted workplace platforms are used to lower a victim’s guard.

When the legitimate program opens, it loads the nearby malicious DLL rather than the normal Windows copy. Known as DLL sideloading, this lets the harmful code operate under the appearance of a signed application.

The DLL makes an encrypted connection to an AWS API Gateway endpoint, an example of how attackers can hide command traffic within ordinary cloud service activity.

Hidden Shell Evades Detection

The sideloaded DLL does not itself provide the attacker with the final command prompt. Instead, it uses Windows Management Instrumentation, or WMI, to start a separate reverse-shell program.

That separation weakens simple process-tree checks because the malicious shell is not launched directly by the signed loader, a tactic also seen in recent DLL sideloading campaigns.

The shell listens only on the infected computer’s local address and exchanges data with the DLL, which retains the outside connection.

It then opens a hidden command prompt that attackers use to check the logged-in user, network settings, domain accounts and device registration.

The group can also inspect cloud-synced document folders, creating an immediate risk to business data and identity information.

Defenders should restrict or closely monitor Teams contact from untrusted external accounts, and make clear that IT staff will not request Quick Assist access through unsolicited chats or calls.

Organizations should review whether Quick Assist is necessary, train employees to independently confirm support requests, and investigate unusual remote sessions promptly.

Guidance from Microsoft Teams vishing attacks reinforces that a request to start remote-support software deserves the same caution as a suspicious attachment.

Security teams should watch for signed applications loading unsigned DLLs from their own folders, unexpected WMI-spawned processes and unusual local listeners.

They should also examine outbound encrypted connections from trusted programs to execute-api endpoints, especially where a child process begins system discovery.

Correlating those signs with recent external Teams contact and Quick Assist activity can expose the operation during early stages of the compromise.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
Domain	`0q8jnro0za.execute-api.us-east-1.amazonaws[.]com`	AWS API Gateway command-and-control endpoint
Domain	`qqcy5av2o2.execute-api.us-east-1.amazonaws[.]com`	AWS API Gateway command-and-control endpoint
Domain	`l9iprxgup2.execute-api.us-east-1.amazonaws[.]com`	AWS API Gateway command-and-control endpoint
Domain	`9stbnu0f0a.execute-api.us-east-1.amazonaws[.]com`	AWS API Gateway command-and-control endpoint
Domain	`software-download-usw1.s3.us-west-1.amazonaws[.]com`	Attacker-controlled S3 payload host
URL	`hxxps[:]//software-download-usw1.s3.us-west-1.amazonaws[.]com/SE15724BW.msi`	Malicious MSI download
SHA-256	`878567e4b6f4552f8f56f300c3a2af0fe9c7935686ee0e34ef5f632c81baa579`	Trojanized Kodi MSI installer
SHA-256	`1423084a8aaa721627f9674fd4ba3679b27acdc7992001b91adb41f0457756b5`	Trojanized Kodi MSI installer
SHA-256	`0112620b7fd940846bac876a9f8a148a7435d34fe0b596edf165325a81efb5b3`	Malicious `vcruntime140.dll` variant
SHA-256	`6b5a6817d6fce0348ac1f4ef38298b57a00c8a8c3f3ca39335ca06a7b861f1d0`	Malicious `vcruntime140_1.dll` variant
SHA-256	`3759aaaea1e9f6228e2701c415882f38ceb3e03b211e82600a6f31c68a4370ba`	Malicious `vcruntime140.dll` variant
SHA-256	`c1bbbac9f501712db13f276d88a17277284e3684b690b33abd3508ef56064860`	Malicious `zlib1.dll` variant
SHA-256	`74fdbe5d2a8b68a145cc79f75432fa8dd4dc71383040873929fca5f8a4f9229a`	Malicious `zlib1.dll` variant
SHA-256	`26e3f1359ed228d9d4931b853f1bfc768c2ca22cb28b96c29380c040940c3a1f`	Malicious `zlib1.dll` variant
SHA-256	`25b4cb9b9ff68487af37fb86b16b6e335d862821fa3749f860933c35013de509`	`File Transfer.exe` custom reverse-shell agent
SHA-256	`7499df565f74bd9d0ad69b1363217d57a65db7a9d4693e6e387b3841458477d7`	`SupportHost.exe` custom reverse-shell agent
SHA-256	`c44af51e75b2023376cf7fa2735d72f1c433d9dc58163dc298690731c80bc7f9`	`Module Agent.exe` custom reverse-shell agent
SHA-256	`fef16f362aa405ab83fe7e7f34948c3b062df9d0701eb883f7834301562fe0ae`	`kodi.exe` binary abused for sideloading
SHA-256	`55bc7d960205ae3265a1bab47bbfa36a774dfe8e8eb4a80c2b78f625e758ba02`	`salamand.exe` binary abused for sideloading
SHA-256	`Ff5ee21e81a38b959d2f4cd275dbf7a778dc72fd0becfdde80ef3f619d0f8b8b`	`filezilla.exe` binary abused for sideloading
File name	`SE15724BW.msi`	Malicious MSI installer
File name	`KB5094126.msi`	Malicious MSI installer
File name	`vcruntime140.dll`	Malicious sideloaded DLL
File name	`vcruntime140_1.dll`	Malicious sideloaded DLL
File name	`zlib1.dll`	Malicious sideloaded DLL
File name	`File Transfer.exe`	Custom reverse-shell agent
File name	`Module Agent.exe`	Custom reverse-shell agent
File name	`SupportHost.exe`	Custom reverse-shell agent
File name	`salamand.lnk`	Startup-folder persistence shortcut
Network listener	`127.0.0.1:9001`	Local TCP relay listener used to bridge command traffic
Mutex	`Global\\ConsoleMutex`	Mutex used by the reverse-shell agent

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Hackers Pose as IT Support on Microsoft Teams to Take Remote Control of Windows PCs appeared first on Cyber Security News.