Hackers Impersonate IT Help Desk on Microsoft Teams to Steal Windows Passwords
Attackers impersonate IT help desks in Microsoft Teams to deliver SynkLoader and steal Windows passwords.
Attackers are using Microsoft Teams external chats from Microsoft 365 tenants they control to impersonate IT help desks and trick employees into installing malware or approving remote access. One campaign delivered SynkLoader as a malicious MSI hosted on Azure storage; it can run largely in memory and persist through scheduled tasks. Its PhishLocker module displays a fake Windows lock screen that captures the password the user types. Microsoft recommends restricting Teams external access to trusted domains and verifying unexpected support requests through a known internal channel.
- Campaigns use attacker-controlled Microsoft 365 tenants and Teams external chat.
- Victims are pushed to run an MSI, open Quick Assist, or share a remote code.
- SynkLoader persists with scheduled tasks and can run largely in memory.
- PhishLocker shows a fake Windows lock screen and captures the typed password.
- Microsoft advises limiting Teams external access to trusted domains.
- ATT&CK
- T1566.003 Spearphishing via ServiceT1204.002 Malicious FileT1219 Remote Access ToolsT1053.005 Scheduled TaskT1056.002 GUI Input Capture
- Vendors
- Microsoft
- Malware
- SynkLoaderPhishLocker
- Organizations
- ScamDrill
From the original article
3 min read at cybersecuritynews.com
Hackers are abusing Microsoft Teams chats to impersonate IT help desk staff, trick employees into installing malware or granting remote access, and steal Windows passwords through a fake lock screen. The attacks don’t require a software vulnerability they rely on an employee trusting a convincing message from what appears to be internal IT support. Attackers […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.