Cybercriminals have launched a deceptive campaign impersonating IT support via Microsoft Teams to commandeer Windows computers. They initiate contact with employees from external Teams accounts, posing as technicians and persuading users to grant access through Quick Assist—a legitimate Windows remote support tool. Once access is granted, attackers install malware without needing to exploit software flaws or compromise passwords first.
The Attack Flow and Tools Used
The operation begins when the attacker, positioned as a support person, instructs the target to open Quick Assist during a Teams call. After gaining remote control, the attacker downloads a malicious MSI installer hosted on an Amazon S3 bucket, disguising it as a routine update. Alongside this, the attacker also drops a signed application paired with a harmful DLL, leveraging DLL sideloading to mask the malicious activity under the umbrella of trusted software.
This DLL doesn’t provide a direct external connection. Instead, it uses Windows Management Instrumentation (WMI) to trigger a separate reverse-shell component. The shell, which listens locally only, interacts with the malicious DLL that maintains the actual connection to the outside via AWS API Gateway endpoints. Through this layered approach, attackers can stealthily explore the system—checking user privileges, network configuration, domain membership, device registration, and even syncing cloud document folders.
Detection, IoCs, and Defensive Measures
Security experts identified a set of indicators of compromise including domains such as “execute-api.us-east-1.amazonaws[.]com” and sources like an attacker-controlled S3 bucket hosting malicious MSI files. Sample hash values of compromised installers and DLLs were also documented.
To counter such attacks, it’s advised to restrict or closely monitor external Teams messages from unknown accounts. Employees should be trained to verify any unsolicited support request through established internal channels, rather than following instructions from the person reaching out. Organizations should also re-evaluate whether allowing Quick Assist by default remains safe.
From a technical defense standpoint, teams should look out for signed applications loading unsigned DLLs, unexpected WMI-spun processes, and local listeners opening connections to trusted programs. Monitoring outbound encrypted traffic from trusted apps—especially towards API gateways—and correlating it with external Teams contact can help catch compromises early in the attack chain.
This campaign highlights how attackers are increasingly abusing legitimate tools and cloud services to bypass traditional security checks. The blend of social engineering, remote control misuse, and hidden command & control traffic demonstrates hacking is becoming more insidious—disguising itself in trusted environments to exploit simple user trust.
