Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft Threat Intelligence identified a human-operated campaign leveraging Microsoft Teams external collaboration to impersonate IT support and socially engineer victims into granting remote access using legitimate remote monitoring tools. Once access is established, attackers deploy malicious MSI packages via PowerShell, setting up a portable Node.js runtime and obfuscated JavaScript implant for persistent command execution. The attackers conduct extensive Active Directory reconnaissance, capture screenshots periodically, and move laterally using Windows Remote Management toward critical infrastructure like domain controllers. The campaign is notable for its use of legitimate tools throughout, making detection challenging. The targeting patterns indicate preparation for data theft, extortion, or ransomware attacks.

The campaign enables attackers to gain enterprise-wide access by impersonating IT support and abusing legitimate remote access tools. This access allows persistent command execution, extensive reconnaissance of Active Directory, and lateral movement to critical assets including domain controllers. The intrusion can lead to data theft, extortion, or ransomware deployment, posing significant risk to enterprise security and operations.

No official patch or fix is applicable as this is a social engineering and operational security threat rather than a software vulnerability. Organizations should enhance user awareness training to recognize IT support impersonation and suspicious remote access requests. Monitoring for unusual use of remote monitoring tools and PowerShell execution may help detect activity. Since the campaign uses legitimate tools, behavioral detection and anomaly monitoring in Active Directory and network activity are recommended. Refer to the Microsoft advisory for detailed guidance: https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/