Teams Helpdesk Impersonation: MSI Loader and Node.js Implant Turn a Remote Session Into Enterprise-Wide Access

Microsoft Threat Intelligence investigated a human-operated intrusion campaign in which threat actors impersonated IT support personnel over Microsoft Teams and convinced users to grant remote access to their devices. The operators approached targets with lures involving security updates, spam-filter changes, account verification, or pending account deactivation, and in some cases moved the conversation to a voice call to avoid leaving instructions or links in Teams chat logs. Targets were then persuaded to bypass external-contact warnings, start a remote support session, and approve elevation requests. The activity was not attributed to a known threat actor.

After gaining interactive control, the operator used PowerShell within the remote session to download an installer from attacker-controlled cloud storage and execute it silently under update-themed package names consistent with the IT support pretext. The installer staged a script-based loader and a separately encrypted implant in the user profile, and downloaded a portable Node.js runtime from the official distribution when one was not already present. Hidden bootstrap code launched through trusted Windows script hosts then started Node.js and passed the decrypted implant to it through standard input or a temporary script file. The loader and payload used file extensions not normally associated with scripts, while the Node.js runtime was sometimes renamed even though its file metadata still identified it correctly. Persistence was established through an update-themed per-user autostart entry, using either a registry Run value or a shortcut in the Startup folder.

The implant communicated with its command-and-control server over HTTPS at randomized intervals and executed JavaScript tasking returned by the server. The tasking could access Node.js modules, launch processes, read environment variables, and interact with the file system. Recovered builds also contained dormant logic for retrieving an updated command-and-control address from an Ethereum smart contract, although the observed configuration relied on a hardcoded fallback address. Early tasking focused on host reconnaissance, including hardware and locale information, disk inventory, display adapter details, and installed antivirus products, with the latter two also used to identify analysis environments. The implant also captured the desktop repeatedly, resizing and encoding screenshots before writing them to temporary files for transfer.

Reconnaissance then expanded into Active Directory, where the operators used native commands and directory queries to enumerate domain accounts, identify domain-joined servers, resolve their addresses, test administrative reachability, and collect user description fields that could expose privileged account context. The activity was performed at low volume, with randomized delays and management-instrumentation reachability checks used to limit noise. Additional operator-supplied payloads were executed through `rundll32` using named exports and per-execution tokens. The operators then used Windows Remote Management to move laterally across dozens of domain-joined systems, including file, database, and application servers, as well as domain controllers and certificate authorities.