Hackers Abuse Microsoft Teams to Pose as IT Support and Steal Employee Passwords
Threat actors impersonate IT support in Microsoft Teams chats to deliver SynkLoader malware and harvest Windows credentials via fake lock screens.
Attackers create Microsoft 365 tenants with display names like 'IT Service Desk' and contact victims through Teams external access, often using .onmicrosoft.com addresses and professional profile photos to appear legitimate. A documented campaign delivered a 'PowershellCleaner' MSI from Azure Blob Storage that installs SynkLoader, a multi-language loader using Python, PowerShell, C#, and C++ with in-memory loading and scheduled-task persistence. Its PhishLocker module shows a fake full-screen lock screen reusing the device's real wallpaper to capture plaintext credentials, and a reverse proxy routes attacker traffic through the compromised host. Other campaigns abused Quick Assist for interactive control, then used Rclone for reconnaissance, lateral movement, and exfiltration.
- Attackers use M365 tenant display names like 'IT Service Desk' with .onmicrosoft.com addresses to appear trusted
- SynkLoader MSI hosted on Azure Blob Storage loads Python, PowerShell, C#, and C++ components in memory
- PhishLocker fake lock screen captures plaintext passwords using the device's authentic wallpaper
- Reverse-proxy feature routes attacker traffic through compromised endpoints to reach internal services
- Recommend allow-listing external Teams domains and verifying IT requests via known channels
- ATT&CK
- T1656 ImpersonationT1204.002 Malicious FileT1053.005 Scheduled TaskT1219 Remote Access SoftwareT1090.003 Internal Proxy
- Tags
- credential-theftit-impersonationmicrosoft-teamsphishlockerquick-assistrclonesocial-engineeringsynkloader
- Vendors
- MicrosoftQuick AssistRclone
- Malware
- SynkLoaderPhishLocker
From the original article
3 min read at gbhackers.com
Threat actors are increasingly abusing Microsoft Teams’ external chat capabilities to impersonate corporate IT help desks. They trick employees into installing malware, granting remote access, and stealing Windows credentials. These attacks exploit a simple vulnerability: employees tend to distrust suspicious emails but often do not apply the same caution to collaboration platforms like Teams.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.