Microsoft: Threat actors impersonate IT support on Teams to deploy Node.js implants and pivot to domain controllers

Microsoft Threat Intelligence reports a human-operated campaign in which attackers pose as IT help-desk staff over Microsoft Teams, persuade employees to grant remote sessions, and silently install an MSI that stages a portable Node.js JavaScript backdoor for…

Microsoft Threat Intelligence (2026-09-02) details a hands-on-keyboard campaign in which operators abuse Microsoft Teams external collaboration to impersonate IT/helpdesk staff, persuading users to grant remote sessions via Quick Assist or RMM tools. The Hacker News (2026-09-03) and GBHackers (2026-09-08) corroborated the disclosure. During a session, operators run PowerShell to silently install a malicious MSI via msiexec; the MSI stages a portable Node.js runtime and a JavaScript implant for HTTPS C2. Microsoft describes the implant as obfuscated JavaScript, while GBHackers describes it as encrypted JavaScript running through portable Node.js. GBHackers adds that the backdoor persists via EdgeUpdate Run keys or Startup-folder entries and uses HTTPS long-polling C2. The implant captures desktop screenshots, executes follow-on payloads via rundll32 (per Microsoft), and performs host and Active Directory reconnaissance, including ADSI queries to map domain accounts (per Microsoft). Operators then pivot laterally over WinRM on TCP port 5985 to domain controllers and certificate authorities. GBHackers maps initial access to MITRE ATT&CK T1566.003 (Spearphishing via Service) and notes that no Teams vulnerability is exploited — the campaign weaponizes trust in IT-support workflows. Microsoft warns that the resulting credential-backed access can precede data theft and ransomware, and published hunting and mitigation guidance; GBHackers reports defenders are urged to restrict Teams external collaboration and verify support requests out-of-band.

• Human-operated campaign: attackers impersonate IT/helpdesk staff via Microsoft Teams external collaboration and persuade users to grant remote sessions using Quick Assist or RMM tools.
• Operators run PowerShell to silently install a malicious MSI via msiexec; the MSI stages a portable Node.js runtime plus a JavaScript implant (described as obfuscated by Microsoft, encrypted by GBHackers).
• Implant uses HTTPS C2 (GBHackers specifies long-polling) and persists via EdgeUpdate Run keys or Startup-folder entries (reported by GBHackers).
• Follow-on payloads are executed via rundll32; the chain includes host and Active Directory reconnaissance, ADSI queries mapping domain accounts, and desktop screenshot capture.
• Lateral movement occurs over WinRM on TCP port 5985 to domain controllers and certificate authorities.
• Initial access maps to MITRE ATT&CK T1566.003 (Spearphishing via Service); no Microsoft Teams vulnerability is exploited — the campaign abuses trust in support workflows (GBHackers).
• Microsoft warns the credential-backed access can precede data theft and ransomware.
• Mitigations: restrict Teams external collaboration and verify support requests out-of-band; Microsoft shared hunting and mitigation guidance.