A chat request from an account that looks like the company help desk, a short Quick Assist code read out over the phone, and a few minutes later a JavaScript backdoor is running on the employee's PC. That is the chain Microsoft Threat Intelligence described on 2 September: a human-operated campaign that abuses Microsoft Teams external collaboration to impersonate IT staff and ends with the attacker probing domain controllers over Windows Remote Management.
Microsoft's researchers Sagar Patil, Arlette Umuhire Sangwa, Jesse Birch and Ravikant Tiwari say the intrusion relies on legitimate tooling at almost every stage. Nothing in the chain exploits a software flaw, and Microsoft is explicit that it does not stem from a weakness in Teams. The attacker's work is persuading the user to click through the external-tenant warnings.
It lands three days after Unit 42 documented a separate Teams help-desk campaign that also ended in a run at the domain controller, which suggests the opening move is now standard rather than one crew's trick.
The victim installs the malware themselves
The operator works from a separate tenant and opens a Teams chat or call posing as IT (spearphishing via service), with pretexts like "Microsoft Security Update" or a task that supposedly stops an account being deactivated. A voice call is sometimes layered on top so the instructions never land in chat logs. The user is talked into approving a "request control" prompt during a Teams screen share, or into opening Quick Assist and reading back the code. With control, the attacker runs PowerShell to pull a malicious MSI named something like "devfix" or "Hotfix" from a widely used cloud storage service and installs it silently with msiexec /qn.
A signed runtime running an encrypted script
The MSI drops a script-based loader and an encrypted implant file under the user's LocalAppData folder, then fetches the legitimate portable Node.js runtime from the official distribution if it is not already present. The loader decrypts the implant at runtime and feeds it to Node.js. Loaders use extensions like .tmp, .ini or .cfg, and Node.js is sometimes renamed, so controls that only watch unsigned executables and conventional script extensions miss it. Persistence is a Run value or Startup shortcut named EdgeUpdate.
The implant polls its command-and-control server over randomized HTTPS requests and executes whatever JavaScript comes back. Observed tasking collected hardware, antivirus and display-adapter details, the latter a classic sandbox check, and repeatedly captured the desktop for exfiltration (screen capture). The recovered builds also carry dormant code to fetch a new C2 URL from an Ethereum smart contract.
From one desktop to the certificate authority
With the foothold confirmed, the operator turns to Active Directory. ADSI queries sweep for Windows Server objects and probe each for administrative reachability, building a live map of high-value targets, and a second query pulls every user object's description attribute, a field that often holds privileged-account notes. Follow-on payloads arrive as DLLs launched through rundll32.
Tasking through the Node.js backdoor opened WinRM connections on TCP port 5985 to dozens of domain-joined hosts, including domain controllers and certificate authorities. Microsoft reads that as credential-backed lateral movement directed by an external operator, consistent with activity that precedes data theft, extortion or ransomware deployment. The report does not attribute the campaign to a named group.
Restrict external Teams contact and WinRM
Microsoft's guidance starts with people: set internal help-desk authentication phrases, and treat any unsolicited external Teams contact claiming to be IT as suspicious until verified through a known internal channel. Then limit Teams external access to trusted domains, require MFA and managed devices, restrict WinRM to management workstations, and control which remote-assistance tools are allowed. Anyone who finds these indicators should rotate every credential reachable from the affected host, domain admin accounts included. Defender detections include Trojan:JS/SynkLoader.SA and Trojan:JS/EtherRatz.A!MTB.
Indicators
Three of the six SHA-256 hashes Microsoft published for the campaign's files: 4cfdcae6dd1d6d98b870c8f0654d504f2bf10479a117dc297de789c249dc389d, a4d145a6347e47d40b3ca48af5c6dba01bf019d0110e31a44bb70fc77d1d1676 and cc6d0f3f47afeba018173604e34f527e8413d3a54ffb35caed529bff49055ec5. The full list is in the report.
Every tool in this chain is one an IT department might legitimately use on a Tuesday afternoon. The only reliably malicious component is the story told to the person at the keyboard.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.