Fake IT Support on Microsoft Teams Is Now a Full Corporate Break-In
Microsoft says attackers are cold-calling staff on Teams, talking them into a screen share, then walking straight through the network to domain controllers.
Key points
- Microsoft Threat Intelligence has documented a live intrusion campaign where attackers pose as helpdesk staff on Microsoft Teams, talk the user into a remote session, then push a hidden JavaScript backdoor built on Node.js.
- The attackers don't stop at stealing passwords: they hand-drive the machine, map the company's internal directory, and jump to domain controllers over a Windows admin protocol called WinRM (port 5985).
- The installer disguises itself as an update named "devfix" or "Hotfix" and runs silently through msiexec, a normal Windows tool.
- Every stage relies on legitimate software: Teams, remote support apps, Windows Installer, Node.js. Almost nothing looks suspicious to standard monitoring.
- The Payload extortion crew alone has listed 74 claimed victims since February 2026, mostly manufacturers. Helpdesk impersonation is one of their preferred entry routes.
Someone pings a worker on Microsoft Teams pretending to be from the IT helpdesk, asks to "quickly check" their machine, and forty minutes later has a foothold on the domain controller. That's the intrusion pattern Microsoft's threat intelligence team laid out this week, and it matches what engineers on the incident side have been seeing in customer environments for months.
Not clever malware. A phone-call scam wearing an enterprise badge.
How does the attack actually start?
An attacker sets up their own Microsoft 365 tenant, a paid Microsoft account for a fake business, and uses it to contact staff at the target. The chat arrives with an "External" warning, but the lure is written to override it: "Microsoft Security Update," "Spam Filter Update," or a threat that the user's account is about to be deactivated.
Vishing is sometimes layered on top: a live voice call, instead of email, that keeps malicious instructions out of the written chat log and makes later forensics harder.
The goal is one click. Walk the user through opening a remote support tool, either Quick Assist or a third-party remote management app, and read back a short connection code. That code hands a stranger full control of the desktop. We covered this exact playbook on 7 September, when a modified version of ScreenConnect pulled off the same trick.
What happens once they're in?
PowerShell downloads an installer from cloud storage. The file is named to look like a patch: "devfix.msi" or "Hotfix.msi". It installs silently.
Inside that installer is a small loader and an encrypted payload. If the machine doesn't already have Node.js, a legitimate programming runtime, the loader downloads the official portable copy from Node's own site. The payload decrypts and runs as a JavaScript program that calls home over HTTPS.
From there an operator, a human at a keyboard somewhere, takes screenshots, enumerates user accounts and servers, then pivots to other machines using WinRM. The prize is the domain controller, the server that holds every account credential in the company.
Why this matters beyond one company
This is the front half of a ransomware attack. The reconnaissance, the WinRM pivoting, the interest in certificate authorities: same script, same sequence. Microsoft's writeup stops short of naming the operator, and that's probably right: the tradecraft is generic enough that multiple crews are running it.
Our August piece on SynkLoader documented attackers using Teams impersonation to push modular malware. The September piece on Spring Ring put a number on it: more than 150 employees at ten-plus companies tricked through the same fake-helpdesk approach. This is the third Teams-impersonation intrusion chain we've reported in four weeks.
Should you worry?
Yes, but the fix isn't complicated. Your real IT team won't cold-contact you on Teams from an outside company and ask to take over your screen. If a chat window shows "External" next to the sender and that sender wants a remote session, hang up. Call your helpdesk on a number you already have.
For security teams, the failure mode is trusting the collaboration platform because it lives inside the corporate suite. Block external Teams chat by default, restrict MSI installs, and alert on any process tree where Quick Assist or a remote support tool is followed within minutes by PowerShell reaching out to cloud storage.
The post-mortem will say the warning banner was there. The user clicked past it because the person on the phone sounded like IT.
