IT helpdesk impersonation hits Microsoft Teams once again, with the hackers hiding their activity within legitimate…
- Microsoft warns of Teams‑based campaign where attackers impersonate IT staff
- Victims tricked into granting remote access, leading to malware, lateral movement, and ransomware
- Defenses: verify support contacts, train staff, harden Teams, and use Defender Safe Links/ZAP
Microsoft is warning about an ongoing hacking campaign that starts with a Teams message and ends with a ransomware infection and data theft.
In a new in-depth report published on the Microsoft blog, it was said that unnamed threat actors were reaching out to their targets at various enterprises via a Teams chat, while impersonating IT staff.
They were coercing their victims into granting remote access via screen sharing or remote monitoring and management tools and once received, used their access to install malware loaders and various other implants.
How to defend against Teams-borne phishing
The malware was just the first stage of the attack. Subsequent stages include host reconnaissance, security-product and virtualization...
Copyright of this story solely belongs to techradar.com. To see the full text click HERE
