Researchers observed an active campaign where attackers used Microsoft Teams to impersonate IT support and trick a user into running a PowerShell command. That action downloaded a malicious package that enabled credential theft (via a fake lock screen) and helped attackers move through internal systems while hiding their command-and-control traffic inside trusted Microsoft 365 services.
The campaign began with a Microsoft Teams message in which an attacker posed as internal IT support and convinced a target to run a PowerShell command. That single action downloaded an archive containing a Python runtime and a large compiled payload that acted as a loader for the TWINLOOT implant. From there, the implant was positioned to steal credentials and move deeper into the environment.
The pretext relied on trust in a familiar internal channel. Microsoft Teams is widely used for legitimate IT communication, so a message claiming to be from support did not stand out as unusual on its face. Employees are conditioned to follow instructions from IT quickly, especially when framed as a fix, which made the request to run a PowerShell command seem like a normal troubleshooting step rather than a red flag.
Once installed, the implant used a pixel-perfect fake lock screen to harvest Windows credentials. Regardless of what the victim typed, they were shown an error message stating the password was incorrect and told to try again, a technique likely designed to capture the correct password on a second attempt. Every password captured this way was encrypted and uploaded to a SharePoint drive, keeping the exfiltration path inside a trusted Microsoft service.
A notable feature of this attack is that its entire command-and-control infrastructure operated inside trusted Microsoft services. Tasking flowed through SharePoint Online file dead-drops via the Microsoft Graph API, and Microsoft Teams TURN relays were used to move traffic, making malicious activity harder to distinguish from routine Microsoft 365 usage. Stolen credentials were then used for lateral movement, including RDP and WinRM sessions, through a reverse SOCKS5 tunnel.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The attacker impersonated internal IT support on Microsoft Teams and persuaded a target to run a PowerShell command that downloaded an archive containing a Python runtime and a compiled payload used as a loader.
It uses a pixel-perfect fake lock screen and shows an error message telling the victim the password is incorrect, prompting them to type it again so a correct password gets captured.
It routes tasking through SharePoint Online file dead-drops via the Microsoft Graph API and uses Microsoft Teams TURN relays, blending in with normal Microsoft 365 activity.
Treat the message as suspicious and verify the request through the official helpdesk process before running any commands or downloading anything, since attackers can convincingly impersonate IT support in chat.
“IT support persuaded a target to run a PowerShell command.” That’s how this whole breach started. In this campaign, a fake IT person on Teams sends you a PowerShell command. You run it, it downloads a hidden TWINLOOT package, then later your screen snaps to a pixel-perfect fake Windows lock screen. You type your password, it says, “The password is incorrect. Try again.” That fake lock screen just grabbed every password you entered and quietly sent it out through Microsoft 365 tools like SharePoint and Teams. If “IT support” messages you on Teams asking you to run PowerShell or install a package, stop. Don’t run it, open a ticket in the official helpdesk tool and confirm first.
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Researchers described an active phishing campaign that tricks people with fake Adobe/Zoom update and “document review” themes to install the legitimate ScreenConnect remote-access tool. Once installed, attackers get persistent remote control of the victim’s computer while blending in as normal IT…
North Korea-linked BlueNoroff is using fake Zoom and Microsoft Teams meeting pages shared from hijacked trusted contacts (often via Telegram) to trick victims into “updating” Zoom/Teams and running malicious commands. The phishing kit also fingerprints the victim’s browser to identify installed…
Researchers described a now-patched flaw ("AgentForger") where a single benign-looking ChatGPT link could silently create and publish an attacker-controlled Workspace Agent inside a company. If an employee was already logged in and had connected apps (like email, Drive, Slack, or Teams), the agent…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
Criminals using the “Greatness” phishing-as-a-service kit are running real-world phishing campaigns that trick employees into approving a Microsoft device-code login flow, allowing attackers to bypass MFA and steal access tokens. Recent activity includes RingCentral “voicemail” lures and multi-step…
