Microsoft Teams Help Desk Impersonation: When IT Support Messages You First

Summary

Attackers are impersonating IT support through Microsoft Teams by contacting users from external tenants. They rely on social engineering to convince victims to install malicious MSI packages or grant remote access through Quick Assist. The primary objectives are credential theft, remote control, and establishing persistence inside the victim environment.

Investigation

The investigation identified a malware loader named SynkLoader that uses multiple programming languages and executes largely in memory to evade EDR. Researchers observed a fake Windows lock screen module called PhishLocker designed to capture plaintext passwords, along with a TrafficRedirector reverse proxy used for network tunneling. Evidence also included suspicious scheduled tasks and abuse of legitimate tools such as Rclone for exfiltration.

Mitigation

Organizations should restrict Microsoft Teams external access by maintaining an allow-list of approved domains and blocking untrusted subdomains. Administrators should disable the ability for unmanaged accounts to initiate chats and review settings related to trial-only tenants. Quick Assist should also be disabled or tightly restricted to prevent unauthorized remote sessions.

Response

If malicious activity is detected, affected machines should be isolated from the network while remaining powered on to preserve in-memory artifacts. All active identity sessions should be revoked, and the user’s password reset from a trusted device. A full endpoint reimage is recommended instead of attempting cleanup, followed by blast-radius analysis using Single Sign-On (SSO) logs.

Simulation Execution

• Attack Narrative & Commands: The adversary has gained initial access to the Windows workstation. To facilitate lateral movement and exfiltrate data, they download the chisel binary. Their goal is to set up a tunnel that allows them to reach internal resources from their remote C2 server. They execute chisel.exe to initiate a connection. Because the detection rule looks for the string “chisel” in the process path, this action should trigger a high-severity alert.

• Regression Test Script:

  # Simulation Script: Trigger Reverse Proxy Detection via Chisel
  # Note: This script assumes chisel.exe is present in the current directory.
  # If not present, it will attempt to download a placeholder or fail.
  
  $toolName = "chisel.exe"
  $destination = "8.8.8.8" # Using Google DNS as a dummy destination to simulate a connection attempt
  $port = "80"
  
  Write-Host "[+] Starting simulation: Executing $toolName" -ForegroundColor Cyan
  
  if (Test-Path $toolName) {
      # Execute chisel to create a connection attempt. 
      # We use 'client' mode to attempt an outbound connection.
      Start-Process -FilePath ".$toolName" -ArgumentList "client $destination:$port" -WindowStyle Hidden
      Write-Host "[!] Simulation command sent. Check SIEM for Event ID 3 with image containing 'chisel'." -ForegroundColor Yellow
  } else {
      Write-Error "[!] Error: $toolName not found in current directory. Please place the binary here to run simulation."
  }

• Cleanup Commands:

  # Cleanup: Terminate any running chisel processes and remove the binary.
  Stop-Process -Name "chisel" -ErrorAction SilentlyContinue
  Remove-Item ".chisel.exe" -Force -ErrorAction SilentlyContinue
  Write-Host "[+] Cleanup complete." -ForegroundColor Green