Hackers Exploiting Microsoft Teams to Remotely Access Users’ Systems

Hackers are exploiting Microsoft Teams to deceive users into installing remote access tools, granting attackers control over victims’ systems. Trend Micro analyzed an incident where an attacker, impersonating a trusted client, initiated a Teams call and persuaded the victim to download a remote support application. When installing Microsoft Remote Support failed, the attacker recommended AnyDesk, a legitimate tool often misused by cybercriminals.

Once AnyDesk was installed, the attacker executed commands to gather system information and deployed malware, including Trojan.AutoIt.DARKGATE.D, to establish a connection with a command-and-control server. Although the attack was intercepted before data exfiltration occurred, it underscores the need for robust security measures.

Recommendations to mitigate such attacks include:

• Verify Third-Party Claims: Always confirm the identity of technical support providers before granting system access.
• Control Remote Access Tools: Whitelist approved applications and enforce multi-factor authentication to enhance security.
• Employee Training: Educate staff about social engineering tactics, including phishing and vishing, to reduce vulnerability to such schemes. Learn ethical hacking

This incident highlights how attackers or hackers exploit trust and legitimate platforms like Microsoft Teams to infiltrate systems, emphasizing the importance of vigilance and proactive security measures.

Learn Ethical Hacking Essentials