security: Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft Threat Intelligence describes a human-operated campaign that uses Microsoft Teams external collaboration to impersonate IT support, obtain remote access, and deploy a Node.js-based implant. The post also explains how attackers use legitimate tools for lateral movement and how Microsoft Defender can help detect and disrupt the activity.

• Source: Microsoft Security Blog