Crime crew impersonates help desk, abuses Microsoft Teams to steal your data

Google Threat Intelligence observed an active UNC6692 campaign that begins with a large email spam wave and social engineering via Microsoft Teams helpdesk impersonation; victims are lured to a fake "Mailbox Repair Utility" that captures credentials (including double-entry capture) and stages payloads. The attack deploys AutoHotkey scripts, a malicious Chromium extension (SnowBelt) that installs additional components, a Python-based tunneler (SnowGlaze) and a bindshell (SnowBasin) to give attackers persistent access, remote command execution, and data exfiltration to attacker-controlled infrastructure.