Phishing & fraudhigh
Attackers impersonate IT support on Microsoft Teams to gain remote access
Original title: Hackers Impersonate IT Support on Microsoft Teams to Gain Remote Access to Employees’ PCs
AI summary · x-ai/grok-4.7Summaries by Vani AI
An October 26 Arctic Wolf report on more than 400 incidents also describes a PowerShell and MSI infection chain.
Arctic Wolf said attackers impersonate IT support in Microsoft Teams external chats, often after flooding inboxes, then persuade employees to allow remote access and install software. The activity abuses permitted external messaging rather than a Teams vulnerability. Quick Assist was most often used, along with AnyDesk, ScreenConnect, TeamViewer, and Atera. In a newly described chain, a victim ran PowerShell to launch an MSI from Azure Blob Storage that decrypted further PowerShell, launched a Python implant, queried Active Directory, and sent account details to command-and-control servers.
Unconfirmed: The report does not attribute the more than 400 incidents to a single named group.
Key facts
- Between 30% and 40% of examined cases used default Microsoft tenant domains.
- About half of recent paid-domain identities used the .top extension.
- Customers reported payload execution within 15 minutes of engagement.
- A later remote-management install can persist after the first malware is removed.
- Arctic Wolf flags the ChatCreated event as an early detection point.
Security assessment · AI, from the article
Impact: Remote access, malware installation, and Active Directory enumeration
What to do
- 1.Allow Teams external access only for trusted partner domains where practical.
- 2.Restrict unnecessary remote-support applications and investigate unexpected installs.
- 3.Verify unsolicited help through a known helpdesk number or service portal.
- ATT&CK
- T1566.003 Spearphishing via ServiceT1566.004 Spearphishing VoiceT1219 Remote Access ToolsT1059.001 PowerShell
- Vendors
- Microsoft
- Organizations
- Arctic Wolf
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | assis-programupdate.top | expertassist[.]top sec-check-it[.]top upd-check-soft[.]top assis-programupdate[.]top get-info-check[.]top updsysseq[.]top techrelay[.]top veri |
| domain | corporateitservicellc.onmicrosoft.com | eatpro[.]onmicrosoft[.]com ithelpplus42[.]onmicrosoft[.]com corporateitservicellc[.]onmicrosoft[.]com techsupport2337[.]onmicrosoft[.]com Payload and C2 doma |
| domain | data-sys-seq.top | get-upd-sys[.]top get-sys-info[.]top getsystembridge[.]top data-sys-seq[.]top soft-network[.]top Additional domains in ATT&CK mapping g |
| domain | expertassist.top | program[.]top getsysmonitor[.]top programupdate-assis[.]top expertassist[.]top sec-check-it[.]top upd-check-soft[.]top assis-programupda |
| domain | fix-it.top | t-help-systems[.]top helpdesk-sys[.]top help-desk-get[.]top fix-it[.]top Helpdesk lookalike domains helpdesk-support-us-ny[.]com h |
| domain | get-help-systems.top | top Additional domains in ATT&CK mapping getitconnect[.]top get-help-systems[.]top helpdesk-sys[.]top help-desk-get[.]top fix-it[.]top Helpd |
| domain | get-help.top | echrelay[.]top verifsec-update[.]top sys-update-check[.]top get-help[.]top it-assistant[.]top ms-system-check[.]top scan-updseq[.]to |
| domain | get-info-check.top | eck-it[.]top upd-check-soft[.]top assis-programupdate[.]top get-info-check[.]top updsysseq[.]top techrelay[.]top verifsec-update[.]top sys |
| domain | getitconnect.top | top soft-network[.]top Additional domains in ATT&CK mapping getitconnect[.]top get-help-systems[.]top helpdesk-sys[.]top help-desk-get[. |
| domain | get-sys-info.top | eccontrol[.]top verifcontrol-update[.]top get-upd-sys[.]top get-sys-info[.]top getsystembridge[.]top data-sys-seq[.]top soft-network[.]t |
| domain | getsysmonitor.top | pdate-software[.]top infoupdate-it[.]top soft-program[.]top getsysmonitor[.]top programupdate-assis[.]top expertassist[.]top sec-check-it |
| domain | getsystembridge.top | ifcontrol-update[.]top get-upd-sys[.]top get-sys-info[.]top getsystembridge[.]top data-sys-seq[.]top soft-network[.]top Additional domains |
| domain | get-upd-sys.top | -updseq[.]top it-seccontrol[.]top verifcontrol-update[.]top get-upd-sys[.]top get-sys-info[.]top getsystembridge[.]top data-sys-seq[.]t |
| domain | ggc.com.ph | al-phishing domains kilan[.]com[.]pl saludcentro[.]gov[.]co ggc[.]com[.]ph scapini[.]com[.]br Files and execution artifacts archiv |
| domain | helpdesk-call.com | helpdesk-support-office-4[.]com helpdesk-support-us3[.]com helpdesk-call[.]com helpdesk-s1x[.]com itdeskassist[.]com Payload or credenti |
| domain | help-desk-get.top | etitconnect[.]top get-help-systems[.]top helpdesk-sys[.]top help-desk-get[.]top fix-it[.]top Helpdesk lookalike domains helpdesk-support- |
| domain | helpdesk-s1x.com | fice-4[.]com helpdesk-support-us3[.]com helpdesk-call[.]com helpdesk-s1x[.]com itdeskassist[.]com Payload or credential-phishing domains |
| domain | helpdesk-support-office-3.com | top Helpdesk lookalike domains helpdesk-support-us-ny[.]com helpdesk-support-office-3[.]com helpdesk-support-office-4[.]com helpdesk-support-us3[.]co |
| domain | helpdesk-support-office-4.com | elpdesk-support-us-ny[.]com helpdesk-support-office-3[.]com helpdesk-support-office-4[.]com helpdesk-support-us3[.]com helpdesk-call[.]com helpdesk-s |
| domain | helpdesk-support-us3.com | desk-support-office-3[.]com helpdesk-support-office-4[.]com helpdesk-support-us3[.]com helpdesk-call[.]com helpdesk-s1x[.]com itdeskassist[.]com |
| domain | helpdesk-support-us-ny.com | help-desk-get[.]top fix-it[.]top Helpdesk lookalike domains helpdesk-support-us-ny[.]com helpdesk-support-office-3[.]com helpdesk-support-office-4 |
| domain | helpdesk-sys.top | in ATT&CK mapping getitconnect[.]top get-help-systems[.]top helpdesk-sys[.]top help-desk-get[.]top fix-it[.]top Helpdesk lookalike domai |
| domain | helpdeskteam365.onmicrosoft.com | dge33[.]onmicrosoft[.]com supportedge39[.]onmicrosoft[.]com helpdeskteam365[.]onmicrosoft[.]com itendpoint365[.]onmicrosoft[.]com itcoreportal[.]onmicr |
| domain | infoupdate-it.top | ]com Payload and C2 domains, appendix update-software[.]top infoupdate-it[.]top soft-program[.]top getsysmonitor[.]top programupdate-assi |
| domain | itadmin922.onmicrosoft.com | 797[.]onmicrosoft[.]com networkadmin916[.]onmicrosoft[.]com itadmin922[.]onmicrosoft[.]com supportagentonline[.]onmicrosoft[.]com threatpro[.]onmi |
| domain | it-assistant.top | verifsec-update[.]top sys-update-check[.]top get-help[.]top it-assistant[.]top ms-system-check[.]top scan-updseq[.]top it-seccontrol[.]t |
| domain | itcoreportal.onmicrosoft.com | am365[.]onmicrosoft[.]com itendpoint365[.]onmicrosoft[.]com itcoreportal[.]onmicrosoft[.]com networkadmin797[.]onmicrosoft[.]com networkadmin916[.]o |
| domain | itdeskassist.com | sk-support-us3[.]com helpdesk-call[.]com helpdesk-s1x[.]com itdeskassist[.]com Payload or credential-phishing domains kilan[.]com[.]pl s |
| domain | itendpoint365.onmicrosoft.com | e39[.]onmicrosoft[.]com helpdeskteam365[.]onmicrosoft[.]com itendpoint365[.]onmicrosoft[.]com itcoreportal[.]onmicrosoft[.]com networkadmin797[.]onmi |
| domain | ithelpplus42.onmicrosoft.com | entonline[.]onmicrosoft[.]com threatpro[.]onmicrosoft[.]com ithelpplus42[.]onmicrosoft[.]com corporateitservicellc[.]onmicrosoft[.]com techsupport23 |
| domain | it-seccontrol.top | it-assistant[.]top ms-system-check[.]top scan-updseq[.]top it-seccontrol[.]top verifcontrol-update[.]top get-upd-sys[.]top get-sys-info[ |
| domain | kilan.com.pl | m itdeskassist[.]com Payload or credential-phishing domains kilan[.]com[.]pl saludcentro[.]gov[.]co ggc[.]com[.]ph scapini[.]com[.]b |
| domain | ms-system-check.top | op sys-update-check[.]top get-help[.]top it-assistant[.]top ms-system-check[.]top scan-updseq[.]top it-seccontrol[.]top verifcontrol-update |
| domain | networkadmin797.onmicrosoft.com | int365[.]onmicrosoft[.]com itcoreportal[.]onmicrosoft[.]com networkadmin797[.]onmicrosoft[.]com networkadmin916[.]onmicrosoft[.]com itadmin922[.]onmicr |
| domain | networkadmin916.onmicrosoft.com | tal[.]onmicrosoft[.]com networkadmin797[.]onmicrosoft[.]com networkadmin916[.]onmicrosoft[.]com itadmin922[.]onmicrosoft[.]com supportagentonline[.]onm |
| domain | programupdate-assis.top | infoupdate-it[.]top soft-program[.]top getsysmonitor[.]top programupdate-assis[.]top expertassist[.]top sec-check-it[.]top upd-check-soft[.]to |
| domain | saludcentro.gov.co | com Payload or credential-phishing domains kilan[.]com[.]pl saludcentro[.]gov[.]co ggc[.]com[.]ph scapini[.]com[.]br Files and execution a |
| domain | scan-updseq.top | top get-help[.]top it-assistant[.]top ms-system-check[.]top scan-updseq[.]top it-seccontrol[.]top verifcontrol-update[.]top get-upd-sys |
| domain | scapini.com.br | ains kilan[.]com[.]pl saludcentro[.]gov[.]co ggc[.]com[.]ph scapini[.]com[.]br Files and execution artifacts archive6.zip cleaner.ps1 |
| domain | sec-check-it.top | smonitor[.]top programupdate-assis[.]top expertassist[.]top sec-check-it[.]top upd-check-soft[.]top assis-programupdate[.]top get-info-c |
| domain | soft-network.top | get-sys-info[.]top getsystembridge[.]top data-sys-seq[.]top soft-network[.]top Additional domains in ATT&CK mapping getitconnect[.]top g |
| domain | soft-program.top | domains, appendix update-software[.]top infoupdate-it[.]top soft-program[.]top getsysmonitor[.]top programupdate-assis[.]top expertassis |
| domain | supportagentonline.onmicrosoft.com | admin916[.]onmicrosoft[.]com itadmin922[.]onmicrosoft[.]com supportagentonline[.]onmicrosoft[.]com threatpro[.]onmicrosoft[.]com ithelpplus42[.]onmicrosof |
| domain | supportedge33.onmicrosoft.com | ):- Type Source-reported indicators Attacker tenant domains supportedge33[.]onmicrosoft[.]com supportedge39[.]onmicrosoft[.]com helpdeskteam365[.]onm |
| domain | supportedge39.onmicrosoft.com | s Attacker tenant domains supportedge33[.]onmicrosoft[.]com supportedge39[.]onmicrosoft[.]com helpdeskteam365[.]onmicrosoft[.]com itendpoint365[.]onm |
| domain | sys-update-check.top | .]top updsysseq[.]top techrelay[.]top verifsec-update[.]top sys-update-check[.]top get-help[.]top it-assistant[.]top ms-system-check[.]top s |
| domain | techrelay.top | is-programupdate[.]top get-info-check[.]top updsysseq[.]top techrelay[.]top verifsec-update[.]top sys-update-check[.]top get-help[.]t |
| domain | techsupport2337.onmicrosoft.com | onmicrosoft[.]com corporateitservicellc[.]onmicrosoft[.]com techsupport2337[.]onmicrosoft[.]com Payload and C2 domains, appendix update-software[.]top |
| domain | threatpro.onmicrosoft.com | [.]onmicrosoft[.]com supportagentonline[.]onmicrosoft[.]com threatpro[.]onmicrosoft[.]com ithelpplus42[.]onmicrosoft[.]com corporateitservicellc[ |
| domain | update-software.top | rt2337[.]onmicrosoft[.]com Payload and C2 domains, appendix update-software[.]top infoupdate-it[.]top soft-program[.]top getsysmonitor[.]to |
| domain | upd-check-soft.top | ramupdate-assis[.]top expertassist[.]top sec-check-it[.]top upd-check-soft[.]top assis-programupdate[.]top get-info-check[.]top updsysseq[ |
| domain | updsysseq.top | k-soft[.]top assis-programupdate[.]top get-info-check[.]top updsysseq[.]top techrelay[.]top verifsec-update[.]top sys-update-check[.] |
| domain | verifcontrol-update.top | ms-system-check[.]top scan-updseq[.]top it-seccontrol[.]top verifcontrol-update[.]top get-upd-sys[.]top get-sys-info[.]top getsystembridge[.]to |
| domain | verifsec-update.top | [.]top get-info-check[.]top updsysseq[.]top techrelay[.]top verifsec-update[.]top sys-update-check[.]top get-help[.]top it-assistant[.]top |
From the original article
4 min read at cybersecuritynews.com
Hackers are impersonating IT support staff on Microsoft Teams to persuade employees to grant remote access to their Windows computers. The activity combines convincing helpdesk identities, unwanted email floods, and legitimate remote support tools, turning an apparently routine workplace conversation into an opportunity to install malware and investigate corporate networks. The attacks exploit trust rather […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.