Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft Threat Intelligence details a hands-on-keyboard intrusion campaign where attackers impersonate IT/helpdesk via Microsoft Teams to convince users to grant remote control, then use PowerShell to silently install an MSI that stages a portable Node.js runtime and an obfuscated JavaScript implant. The implant provides randomized HTTPS C2, enables reconnaissance (AD enumeration, host discovery), periodic screen capture, execution of follow-on payloads via rundll32, and credential-backed lateral movement over WinRM targeting domain controllers and certificate authorities; the report includes MITRE mappings, IOCs (hashes and domains), Defender/XDR detections, and mitigation/hunting guidance.