Your helpdesk can be impersonated by anyone who can open a Microsoft Teams chat from outside your tenant. An IT support impersonation campaign documented by Microsoft Threat Intelligence is built on exactly that gap. An operator posing as internal IT support talks an employee into granting a remote session, then rides trusted Windows tooling toward the domain controller. There is no exploit in the chain; the thing that breaks is the user’s trust.
From a Teams Chat to the Domain Controller
The operator opens from an external tenant, impersonating IT or helpdesk staff. A little pressure gets the target to approve a “request control” prompt in a Teams screen-share, or to read back a code from Quick Assist, Microsoft’s built-in remote-assistance tool. Microsoft maps this initial access to MITRE ATT&CK technique T1566.003, spearphishing via service. Once the session is live, the operator runs PowerShell to pull a malicious Windows Installer package (MSI) from cloud storage and installs it silently with msiexec, so the victim never sees an install prompt. The package stages a portable Node.js runtime pulled from the official Node.js distribution alongside an encrypted script, giving the operator a signed interpreter to run attacker code without dropping an unsigned binary.
From there the Node.js implant polls a command and control (C2) server over randomized HTTPS requests, captures periodic screenshots, and enumerates the host and Active Directory. Its lateral movement rides Windows Remote Management (WinRM) on TCP 5985 toward file servers, database servers, and finally the domain controllers and certificate authorities that anchor identity.
Why IT Support Impersonation Slips Past Signature-Based Controls
Microsoft is careful to say this is not a vulnerability in Microsoft Teams; the platform shows external-tenant labels, Accept and Block prompts, and phishing indicators at first contact. The operationally consequential read is that every one of those controls sits in front of a single human decision, and the campaign is engineered so that once that decision is made, nothing downstream looks abnormal. Endpoint tools that hunt for known malware have little to bite on, because every binary in the chain is signed and legitimate. The operator uses a signed Node.js runtime, pivots over WinRM the same way your administrators do, and runs follow-on code through rundll32 and trusted Windows script hosts. The signal to hunt for is therefore a sequence: a remote-assist process tree that is immediately followed by PowerShell, or a WinRM connection that starts from a user-context process.
The recovered implants even carried dormant code to fetch an updated C2 address from an Ethereum smart contract, a resiliency feature the operators left switched off in favor of a hard-coded fallback. The reconnaissance told the same story of patience, randomized sleep jitter and quiet reachability probes rather than noisy scanning. Pointing WinRM at domain controllers and certificate authorities is the tell that matters, because that identity backbone is what attackers map before data theft, extortion, or ransomware deployment.
Shut the Remote-Session Pathway Before WinRM Fires
Defend where the intrusion actually starts, at the human and the remote-access grant, then constrain the protocols it borrows. The behavior chain is precisely what detection engineering is meant to catch before an operator reaches your identity systems.
Give your helpdesk a verification ritual, not a warning banner – Establish internal helpdesk authentication phrases, and have users confirm any unsolicited IT contact through a known internal channel before granting remote access. The Teams external-tenant label only helps if the user stops to read it.
Constrain the tools the operator borrowed – Limit WinRM on TCP 5985 to authorized management workstations, and alert when it starts from a user-context process. Control which remote monitoring and management (RMM) tools are permitted to run at all, since the entire chain depends on legitimate remote-access software.
Assume the host is a beachhead and rotate credentials – Treat the compromised machine as network-level access. Rotate every credential reachable from it, including domain admin accounts if the host was domain-joined. The IT support impersonation that opened with a routine Teams chat had already put the operator on a path to your domain controllers.
Join our LinkedIn group Information Security Community!
