Attackers posed as internal IT or help-desk staff in Microsoft Teams, then persuaded employees to open Quick Assist and share its connection code. That remote access let the attackers abuse insecure certificate settings, gain privileged access, and in one case copy company data to an external server.
The attackers contacted employees directly in Microsoft Teams, posing as the organization's own IT or help desk. They operated from outside tenants but used support themed display names so the contact appeared familiar and legitimate. Once in a conversation, they asked the employee to open Windows Quick Assist, a built in remote help tool, and to read back the connection code. That single step handed the attacker direct, hands-on control of the workstation.
From that foothold, the attackers escalated in different ways depending on the environment. In one intrusion, they exploited an insecure Active Directory Certificate Services template to obtain certificates for privileged accounts, accessed a domain controller, and used a renamed copy of the file copying tool Rclone to move data from a file share to an external SFTP server. In a second intrusion, attackers used coerced domain controller authentication and AD CS web enrollment to obtain a certificate for the domain controller itself, but isolating the affected workstation stopped the activity before it progressed further.
The approach worked because it relied on a believable premise rather than a technical exploit at the first step. A Teams message that looks like it comes from internal IT, combined with a plausible sounding request to fix a problem, lowered the employee's guard enough to open a remote access tool and read out a code. Quick Assist is a legitimate, built in Windows utility, so the action itself did not look unusual to the employee performing it.
The deeper risk is that this single action created a path to privileged access through certificate issuance, which is harder to detect and remove than a typical compromised credential. The report notes that password resets or wiping the initially compromised workstation may not remove access obtained through improperly issued certificates, which is why the second case required isolating the workstation rather than relying on a simple reset.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers impersonated internal IT or help desk staff on Microsoft Teams from outside tenants with support themed names, then convinced employees to open Windows Quick Assist and read back the connection code, giving the attacker hands on control of the device.
In one intrusion, attackers exploited an insecure Active Directory Certificate Services template to obtain certificates for privileged accounts, reached a domain controller, and copied data to an external SFTP server using a renamed copy of Rclone.
Not necessarily. The report notes that password resets or wiping the initially compromised workstation may not remove access that was obtained through improperly issued certificates.
In the second case, isolating the affected workstation stopped further activity after attackers used coerced domain controller authentication and AD CS web enrollment to obtain a certificate for the domain controller.
“Hi, this is IT support. Please open Quick Assist.” The Teams name looks familiar, but the account is from an outside tenant. They ask for your Quick Assist connection code. Share it, and they can control your PC. Here’s the catch: that one session can outlast a password reset. In one case, insecure AD CS certificates led to privileged access and company data copied to an outside SFTP server. Unexpected Teams support request? Before sharing any code, confirm it through your known internal IT channel.
Microsoft investigated two real intrusions in which attackers impersonated IT support staff through Microsoft Teams messages and calls. They persuaded users to open Quick Assist and share a connection code, then used the remote session to pursue high-impact access to privileged accounts and domain…
Attackers are using Microsoft Teams external chat to pose as internal IT support staff, often after overwhelming employees with email subscription messages. They persuade victims to join a voice call, approve remote-control tools, or run commands, with some incidents ending in malware infections…
Attackers used external Microsoft Teams chats to impersonate internal IT support and convince employees to grant remote access to their Windows computers. In many cases, they first flooded inboxes with subscriptions or confirmation emails, then offered fake assistance and persuaded victims to use…
Attackers overwhelm employees with hundreds of spam messages, then contact them through Microsoft Teams while posing as internal IT support. They offer to fix the inbox problem, move victims into a voice call, and persuade them to install or use remote-access tools such as Quick Assist. The scams…
Microsoft reported real phishing campaigns that trick users into running a legitimate MSP360 remote-management installer disguised as meeting invites, PDFs, and software updates. After MSP360 is installed, attackers use it to silently install ScreenConnect as a second remote-access path, then use…
Researchers observed a real phishing campaign (“CSuite”) heavily targeting U.S. organizations using familiar business-themed lures (DocuSign, Adobe, Zoom/Meet, Dropbox, Microsoft 365). After a victim engages, the attackers either steal Microsoft 365 sessions (enabling mailbox takeover and fraud) or…
