Attackers abuse Microsoft Teams external chats for IT support scams and ransomware deployment

1. Executive summary

Threat actors are using Microsoft Teams external collaboration to impersonate internal IT and helpdesk staff, persuading employees to grant interactive remote sessions through legitimate remote monitoring and management (RMM) tools. Once a session is established, the actor installs a malicious MSI package that stages a portable Node.js runtime and an obfuscated JavaScript implant, then conducts Active Directory reconnaissance and pivots over Windows Remote Management toward domain controllers. Reported outcomes across the cluster of cases include EtherRAT deployment, Chaos ransomware against North American organisations, and hands-on-keyboard intrusions consistent with pre-ransomware activity. No CVE is associated with this item and no CISA KEV entry applies; the attack path depends on user action, not software exploitation. For EMEA financial services the exposure is to helpdesk impersonation and remote-access tooling that is already approved in most estates, which makes the activity hard to separate from legitimate support traffic.

2. Regulatory framing

3. Technical analysis & attack chain

The campaign is a social-engineering intrusion that uses Microsoft Teams external collaboration as the entry channel. Microsoft states the activity does not exploit a weakness in Teams or its built-in protections; the actor persuades the user to override the external-contact warnings Teams already presents. Unit 42's account of the EtherRAT variant begins with a phishing email disguised as an employee survey, followed by a Teams call from someone claiming to be IT support.

Confirmed steps, drawn from Microsoft Threat Intelligence and Unit 42 reporting:

1. The actor operates from a separate Microsoft Teams tenant and initiates a cross-tenant one-on-one chat while impersonating internal IT or helpdesk. Teams audit logs confirm the actor initiated the cross-tenant OneOnOne chat from the attacker-controlled account.
2. The lure varies: "Microsoft Security Update", "Spam Filter Update", "Account Verification", or a warning that the account will be deactivated. The objective is to get the user to accept the external contact and grant remote access.
3. The user hands over remote control and installs a legitimate RMM tool. Unit 42 names HopToDesk and AnyDesk.
4. The actor uses PowerShell to download and silently install a malicious MSI package.
5. The MSI stages a portable Node.js runtime and an obfuscated JavaScript implant that provides persistent command execution and command and control.
6. The actor performs host and Active Directory reconnaissance, including domain enumeration and server discovery, and periodically captures desktop screenshots.
7. Follow-on payloads are executed through trusted Windows binaries, and the actor pivots across the enterprise over WinRM toward high-value assets such as domain controllers.

The EtherRAT variant is a Node.js remote access trojan that runs on Windows, Linux and macOS, with capabilities for command execution, data theft, file manipulation and persistence. Rather than hardcoding its C2, it fetches an active command-and-control server from an Ethereum smart contract, with a conventional domain held in reserve. Unit 42 reports an open directory containing EtherRAT versions 1 through 9, with samples updated as recently as 26 June, indicating continued development. The same reporting links EtherRAT to prior exploitation of the React2Shell vulnerability and to campaigns involving multiple threat groups.

A separate BleepingComputer report describes Teams vishing calls used to gain remote access and deploy Chaos ransomware against North American organisations. Microsoft frames the reconnaissance and WinRM pivoting it observed as consistent with activity that can precede data theft, extortion or ransomware deployment; it does not state that ransomware was deployed in the intrusions it analysed.

Confidence caveats. The technical chain above rests on Microsoft Threat Intelligence and Unit 42 reporting, with the EtherRAT detail single-sourced to Unit 42 as relayed by The Register. The Chaos ransomware link is single-sourced to BleepingComputer and is not corroborated by the Microsoft or Unit 42 material. No threat actor is named in the supplied sources, and no MITRE ATT&CK profile is available for this item, so attribution is unconfirmed. The "hundreds of cases" figure in The Hacker News headline is not broken down by source and should be treated as an aggregate claim rather than a verified count.

4. Mitigation & containment

P1 within 24 hours

• Restrict Microsoft Teams external access. In the Teams admin center, review the external access configuration and disable or allowlist external domains where the business does not require cross-tenant chat. Microsoft notes the attack depends on the user accepting an external contact, so reducing the population that can receive such requests removes the entry point.
• Inventory RMM tools in the estate (AnyDesk, HopToDesk and any others) and block unapproved installers at the endpoint and via application control. Where an RMM tool is approved, restrict it to helpdesk-issued sessions with a ticket reference.
• Hunt Teams audit logs for cross-tenant OneOnOne chat creation from unfamiliar tenants, and for external-participant sessions labelled "External unfamiliar". Unit 42 notes the session title pattern "System Administrator (External unfamiliar) | Microsoft Teams".
• Search endpoint telemetry for files beginning "CtrlVirtualCursorWin_*", which Teams creates during remote control sessions and which indicate an attacker was operating a victim's desktop.

P2 within 72 hours

• Alert on PowerShell spawning an MSI install (msiexec) shortly after an RMM session, and on portable Node.js runtimes appearing outside standard install paths.
• Restrict and monitor WinRM. Limit which hosts can initiate WinRM connections and alert on WinRM sessions originating from user workstations toward servers and domain controllers.
• Review domain controller exposure to workstation-initiated administrative protocols and require tiered administration so that helpdesk-granted sessions cannot reach identity systems.

P3 within 7 days

• Add helpdesk impersonation and unauthorised RMM sessions to the incident management process and to user awareness material, naming the specific lures ("Microsoft Security Update", "Spam Filter Update", "Account Verification", account-deactivation warnings).
• Require callbacks to a known internal number before any remote session is granted, and publish that rule to staff.

5. Indicators of compromise

No atomic network or file indicators (hashes, domains, IPs) are present in the supplied sources. The sources describe observable behaviours, listed below. These are single-sourced to Unit 42 as relayed by The Register and to Microsoft Threat Intelligence; verify before enforcement.

6. Detection

The sources give behavioural and log indicators but no distinctive file strings, command-line flags, mutexes or filenames suitable for a YARA rule beyond the Teams cursor artefact. A Sigma rule is authored below for the Teams and remote-session behaviours.

title: Microsoft Teams external IT-support impersonation and remote session
id: 8f2c1a44-7b6e-4d21-9a3c-5e0b7c9d1f26
status: experimental
description: Detects cross-tenant Microsoft Teams chat from an external unfamiliar tenant and Teams remote-control cursor artefacts consistent with IT-support impersonation
author: Adverse Trace
date: 2026-10-26
references:

  - https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/
  - https://www.theregister.com/cyber-crime/2026/07/07/fake-it-bods-on-microsoft-teams-coax-workers-into-installing-malware/5267610
logsource:
  product: m365
  service: audit
detection:
  selection_chat:
    Operation:

      - 'ChatCreated'
      - 'MessageCreated'
  selection_external:

    - 'External unfamiliar'
    - 'ExternalTenant'
  condition: selection_chat and selection_external
falsepositives:

  - Legitimate cross-tenant collaboration with partner organisations
level: medium

title: Teams remote-control cursor file creation
id: 3d9b6e12-4c8a-4f57-b1e2-7a6c0d8e5b93
status: experimental
description: Detects creation of CtrlVirtualCursorWin_* files that Teams writes during remote control sessions
author: Adverse Trace
date: 2026-10-26
references:

  - https://www.theregister.com/cyber-crime/2026/07/07/fake-it-bods-on-microsoft-teams-coax-workers-into-installing-malware/5267610
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains: 'CtrlVirtualCursorWin_'
  condition: selection
falsepositives:

  - Legitimate Teams remote-control or screen-sharing sessions
level: low

7. Sources

• The Hacker News, "Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware", https://thehackernews.com/2026/10/attackers-use-microsoft-teams-it.html, 2026-10-26
• Microsoft Threat Intelligence, "Impersonating IT support: how threat actors turn a remote session into enterprise-wide access", https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/, 2026-09-02
• BleepingComputer, "Microsoft Teams vishing attacks lead to Chaos ransomware attacks", https://www.bleepingcomputer.com/news/security/microsoft-teams-vishing-attacks-lead-to-chaos-ransomware-attacks/
• BleepingComputer, "Fake IT support calls on Microsoft Teams push EtherRAT malware", https://www.bleepingcomputer.com/news/security/fake-it-support-calls-on-microsoft-teams-push-etherrat-malware/
• Palo Alto Unit 42, "When 'Hi, This Is IT' Comes Through Microsoft Teams", https://unit42.paloaltonetworks.com/microsoft-teams-phishing/
• The Register, "Fake IT bods on Microsoft Teams coax workers into installing malware", https://www.theregister.com/cyber-crime/2026/07/07/fake-it-bods-on-microsoft-teams-coax-workers-into-installing-malware/5267610, 2026-07-07
• Help Net Security, "Attackers call employees' personal phones to break into Microsoft 365 accounts", https://www.helpnetsecurity.com/2026/09/10/microsoft-365-social-engineering-personal-phones/, 2026-09-10

8. Adverse Trace position

No CVE is associated with this item and no CISA KEV entry applies, so severity here is driven by the access the technique yields rather than by a patchable flaw: a successful session hands an external operator credential-backed interactive access to internal infrastructure, and Microsoft's observed reconnaissance and WinRM pivoting are consistent with pre-ransomware activity. The ransomware link is single-sourced to BleepingComputer and the EtherRAT technical detail is single-sourced to Unit 42, so we treat both as reported rather than confirmed, and no actor attribution is possible from the supplied material. Adverse Trace assesses the exposure for EMEA financial services as elevated because the tooling involved (Teams, AnyDesk, HopToDesk, Node.js, WinRM) is already present in most estates. We will monitor for corroborating reporting on the Chaos ransomware link and on EtherRAT C2 infrastructure, and will issue an update if atomic indicators become available for client enforcement.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.