[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fD9smqATDkt_MwPOQHZ05g5Wx86NCKo-aRkvxuvghQsw":3},{"article":4,"iocs":58,"watch_terms":59,"solutions":60,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"a430ef43-7f82-4a81-b9d3-29df3b20052d","Impersonating IT support: how threat actors turn a remote session into enterprise-wide access","impersonating-it-support-how-threat-actors-turn-a-remote-session-into-enterprise-3906a9","Microsoft Threat Intelligence observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT support, gain remote access, and deploy a Node.js-based implant. Learn how attackers move from social engineering to lateral movement using legitimate tools, and how Microsoft Defender helps detect and disrupt the activity. The post Impersonating IT support: how threat actors turn a remote session into enterprise-wide access appeared first on Microsoft Security Blog.","A human-operated campaign uses Microsoft Teams external collaboration to impersonate IT support, tricking users into granting remote access. Once control is established, attackers deploy a Node.js implant, conduct extensive reconnaissance, and move laterally across the enterprise using legitimate tools and protocols like WinRM.","Attackers impersonate IT support via Teams to gain remote access and deploy Node.js implant.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F09\u002F02\u002Fimpersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F04\u002FMS_Actional-Insights_Rapid-response.jpg","2026-09-02T22:51:18+00:00","2026-09-03T04:00:25.417679+00:00",8,[17,20,22,25,27,29],{"name":18,"type":19},"Microsoft Teams","product",{"name":21,"type":19},"Node.js",{"name":23,"type":24},"PowerShell","technology",{"name":26,"type":24},"Active Directory",{"name":28,"type":24},"Windows Remote Management",{"name":30,"type":31},"Microsoft","vendor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":54},{"id":55,"icon":34,"name":56,"slug":57},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",[],[30,18,21],{"controls":61,"vendors":139},[62,90,113],{"slug":63,"name":64,"problem":65,"products":66},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[67,75,82],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":76,"vendor_name":30,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":91,"name":92,"problem":93,"products":94},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[95,103,108],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":104,"product_name":105,"url":106,"description":107},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":76,"vendor_name":30,"vendor_logo":77,"product_slug":109,"product_name":110,"url":111,"description":112},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":114,"name":115,"problem":116,"products":117},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[118,123,131],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":119,"product_name":120,"url":121,"description":122},"managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",[140],{"slug":76,"name":30,"logo_path":77,"roles":141},[142,143],"reported_by","affected",{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":162},"it-support-impersonation-via-teams-leads-to-enterprise-wide-compromise","IT Support Impersonation via Teams Leads to Enterprise-Wide Compromise","Threat actors exploited Microsoft Teams' external collaboration features to impersonate IT support staff, manipulating users into granting full remote desktop access. Once inside, attackers deployed a Node.js-based implant and used legitimate tools like WinRM to move laterally without triggering obvious alerts. This attack succeeded primarily because users lacked the awareness to verify the identity of external requestors and because external Teams access was not sufficiently restricted. The use of living-off-the-land techniques and trusted protocols highlights how social engineering can bypass technical controls entirely when human judgment is the last line of defense.",[149,150,151,152,153,154,155,156,157,158,159,160,161],"CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 IA-8: Identification and Authentication (Non-Organizational Users)","NIST SP 800-207: Zero Trust Architecture","MITRE ATT&CK T1566: Phishing (Social Engineering)","MITRE ATT&CK T1021.006: Remote Services - Windows Remote Management","MITRE ATT&CK T1078: Valid Accounts","GDPR Article 32: Security of Processing (for EU-scope organizations)",{}]