Hackers Impersonate IT Help Desk on Microsoft Teams to Steal Windows Passwords

Attackers are abusing Microsoft Teams by creating malicious Microsoft 365 tenants and impersonating IT helpdesk staff to convince employees to download malicious MSI files or grant remote control; researchers linked a campaign to the SynkLoader malware, whose PhishLocker module displays a fake Windows lock screen to capture plaintext passwords. The report explains the threat actors' TTPs, risks of lateral movement and data theft after remote access, and recommends restricting Teams external access and verifying unsolicited support requests through trusted channels.