Microsoft Teams Exploited for Silent Enterprise Takeovers

Microsoft Defender Security Research Team describes a sophisticated intrusion campaign that exploits cross-tenant Microsoft Teams social engineering to impersonate IT support and obtain remote assistance, then uses legitimate administrative tools and protocols (vendor-signed binaries, WinRM, Level RMM via msiexec) to move laterally and maintain persistence before exfiltrating sensitive documents with Rclone using selective file-type exclusions to reduce detection.