Microsoft Threat Intelligence observed a sophisticated human-operated campaign exploiting Microsoft Teams external collaboration features to impersonate IT helpdesk personnel. Attackers socially engineer users into granting remote access via legitimate remote monitoring tools. Once established, they deploy malicious MSI packages through PowerShell, staging a portable Node.js runtime and obfuscated JavaScript implant for persistent command execution. The campaign progresses through extensive Active Directory reconnaissance, periodic screenshot captures, and lateral movement via Windows Remote Management toward high-value infrastructure including domain controllers. Unlike commodity phishing operations, this hands-on-keyboard intrusion leverages legitimate tooling throughout, blending malicious activity into normal enterprise operations. The reconnaissance patterns and targeting of identity systems indicate precursor activity consistent with data theft, extortion, or ransomware deployment objectives.

Indicators of Compromise

• hash: 4cfdcae6dd1d6d98b870c8f0654d504f2bf10479a117dc297de789c249dc389d
• hash: a4d145a6347e47d40b3ca48af5c6dba01bf019d0110e31a44bb70fc77d1d1676
• hash: cc6d0f3f47afeba018173604e34f527e8413d3a54ffb35caed529bff49055ec5
• hash: 0d2fc28af246f62f27e49207d1f64e236ad9ea029412b27877d1ae6c098e86e3
• hash: 69e10e0cb7bb2137ebea12971adb02c662cf5543a4f8c9530812bcbf7b183a23
• hash: a135fe4df18c711097e69b4f27ea32a74a955160bf2fb12da841f21866d95d87
• domain: dssdfvsdfvsdfvsdgbfbdvdzv.org