Threat Actors Impersonate IT Support via Microsoft Teams to Deploy Node.js Implants

Microsoft Threat Intelligence has documented a high-impact, human-operated intrusion campaign that leverages Microsoft Teams external collaboration features to facilitate social engineering. Threat actors impersonate IT or helpdesk personnel to deceive users into granting interactive remote access via legitimate support tools. Once access is established, the attackers execute PowerShell commands to download and silently install a malicious MSI package. This package stages a portable Node.js runtime and an obfuscated JavaScript implant within user-writable directories (e.g., LocalAppData).

The implant enables persistent command execution and C2 via HTTPS polling. Unlike automated malware, this campaign follows a hands-on-keyboard playbook, conducting extensive host and Active Directory reconnaissance, capturing screenshots, and utilizing native administrative tools for lateral movement. The attackers frequently leverage Windows Remote Management (WinRM) to pivot toward high-value assets, including domain controllers. This intrusion is particularly dangerous because it uses legitimate collaboration, installation, and administration tools to blend into normal enterprise operations, allowing actors to maintain long-term access for data theft or ransomware deployment.

Attack Chain

1. Initial access via Teams (T1566.003): Threat actor initiates contact impersonating IT/helpdesk and persuades the user to approve a remote screen-share or connection request.
2. Remote session and payload delivery: Attacker uses the remote session to execute PowerShell commands that download a malicious MSI from cloud storage.
3. Silent execution: The attacker uses msiexec to silently install the malicious MSI package.
4. Implant staging: The installer drops a script-based loader and fetches a legitimate portable Node.js runtime if not present on the system.
5. Command-and-control establishment: The loader decrypts and executes the JavaScript implant, which initiates HTTPS polling to a C2 server for tasking.
6. Reconnaissance and collection: The attacker uses native tools and ADSI queries to enumerate domain accounts and servers while periodically capturing user desktop screenshots.
7. Lateral movement: The attacker utilizes WinRM (TCP port 5985) to pivot from the compromised workstation to domain controllers and other high-value infrastructure.

Impact

This campaign results in full interactive access to internal systems, enabling attackers to perform lateral movement, credential harvesting, and domain enumeration. The observed reconnaissance patterns toward identity infrastructure (domain controllers, certificate authorities) are consistent with preparatory stages for ransomware deployment, data exfiltration, or long-term persistence in enterprise environments.

Recommendation

Prioritize detection and response by monitoring for unusual administrative activity and collaboration platform abuse.

• Enable monitoring for msiexec processes spawned by non-standard parent processes or PowerShell.
• Monitor for the creation of portable Node.js runtimes or unexpected JavaScript execution within user-writable directories (e.g., LocalAppData).
• Implement strictly scoped monitoring for lateral movement using WinRM (TCP 5985) originating from non-administrative endpoints.
• Train users to recognize and report unsolicited external Teams communications or instructions to override security warnings.
• Deploy endpoint detection and response (EDR) rules to identify unauthorized ADSI queries and suspicious process spawning from remote management software.