MICROSOFT Teams is being abused in a phishing-driven intrusion campaign in which an actor poses as internal IT support in external tenant messages or calls. Victims grant a remote session, after which a silent MSI installer is delivered and executed, installing a Node[.]js-based implant. The attacker’s aim, according to Microsoft Threat Intelligence, is to map Active Directory and push toward domain controllers via WinRM.
The operation blends into normal activity by using signed, trusted components (a Node[.]js runtime) and by delivering a JavaScript payload that runs in memory or in a temporary file, with the loader decrypting the implant as it executes. Evidence described by Microsoft includes remote-control access, screen capture, and a long-polling C2 channel over HTTPS to receive tasks and exfiltrate data.
The campaign’s reconnaissance and lateral movement are deliberate and credential-backed: the operator uses native commands and ADSI queries to enumerate domain accounts, servers, and attributes, then moves laterally through WinRM connections to numerous domain-joined systems, including domain controllers and certificate authorities. Microsoft notes that the activity strongly suggests external-operator–driven credentialed movement, rather than a Teams vulnerability.
Impact is described as potentially enterprise-wide once footholds are gained, though victim counts were not disclosed. Protection guidance focuses on policy and user education (restrict external Teams contact to trusted domains; discourage unapproved remote-support tools), plus technical detection: look for Node[.]js activity in LocalAppData, monitor unusual WinRM connections on port 5985, and audit for EdgeUpdate persistence indicators. Attribution remains unconfirmed; no law‑enforcement action has been reported.