Teams vishing enables remote compromise and credential theft
Threat actors impersonated internal IT over Microsoft Teams and convinced users to start Quick Assist remote sessions. Once connected they harvested credentials via spoofed web forms and deployed MSI packages that sideloaded malicious DLLs to establish command-and-control and persistent access. The campaign exploits permissive Teams external messaging and user trust in collaboration tools.
Rapid7 Guidance on Observed Microsoft Teams Phishing Campaigns
The Rapid7 MDR team is currently monitoring an increase in phishing campaigns where threat actors (TAs) impersonate internal IT departments via Microsoft Teams.