Microsoft Teams Abused in Cyberattack Delivering PowerShell-Based Remote Access Malware

Microsoft Teams is described as being abused by cybercriminals to deliver PowerShell-based remote access malware, with attackers first impersonating IT support and using social engineering to bypass filters and defenses.

The campaign relies on creating or compromising Teams tenants and initiating voice or chat sessions under names such as “IT SUPPORT” or “Help Desk,” often using the Microsoft onmicrosoft[.]com domain and prefixes like “admin” or “supportbotit.” Once a session is accepted, victims are directed to install remote access tools such as QuickAssist or AnyDesk, enabling the adversary to assume control of the endpoint.

The PowerShell payload then executes a multi-stage script that collects host data, encrypts it with AES, and exfiltrates it to a C2 endpoint, with hard-coded AES parameters and an embedded credential prompt that saves credentials to info.txt in the user’s AppData directory.

The script also seeks persistence via a scheduled task named “Google LLC Updater” or a Run registry key and fetches the next-stage script from a backup domain, while communications to the C2 are encrypted and decrypted for execution as PowerShell jobs.