Published on September 2, 2026
Fake IT Support Hackers Abuse Microsoft Teams and Quick Assist to Deploy Reverse Shell
Severity
High
Detail
Threat actors are using fake IT support requests through external Microsoft Teams chats to trick employees into granting remote access via Microsoft’s legitimate Quick Assist application. Once access is granted, attackers deploy a multi-stage reverse shell designed to blend into normal Windows activity and evade traditional security controls.
Researchers Ofek Lahiani and Raz Rubin reported that the campaign relies heavily on social engineering. Attackers pose as IT technicians and convince victims that a technical issue requires remote assistance. After the victim launches Quick Assist and grants access, the attacker gains hands-on control of the endpoint. The attackers then download a malicious MSI installer from an attacker-controlled Amazon S3 bucket and execute it using the legitimate msiexec[.]exe utility. Observed installer names include SE15724BW[.]msi and KB5094126[.]msi.
The MSI package uses legitimate signed applications, including FileZilla, Altap Salamander, or Kodi, alongside malicious DLLs. This allows the activity to appear more legitimate to users and potentially reduces detection by security controls.
How?
The attack begins with threat actors initiating conversations through external Microsoft Teams chats while impersonating internal IT support staff. Victims are informed of a supposed technical issue and instructed to open the legitimate Quick Assist application. After remote access is granted, attackers download and execute a malicious MSI package from an Amazon S3 bucket using msiexec[.]exe. The installer deploys a trusted signed application together with a malicious DLL, enabling DLL side-loading and malware execution under the context of a legitimate process.
The malicious DLL establishes encrypted communications with AWS API Gateway infrastructure and leverages WMI to spawn a reverse shell component. Security teams may observe WmiPrvSE[.]exe spawning unusual child processes such as:
- File Transfer[.]exe
- Module Agent[.]exe
- SupportHost[.]exe
The reverse shell listens locally on 127[.]0[.]0[.]1:9001, while the DLL relays command-and-control traffic between the shell and the AWS-hosted infrastructure. This separation helps evade detection by reducing the correlation between outbound network activity and the interactive shell.Once established, attackers execute commands through a ConPTY pseudo-terminal connected to cmd[.]exe, allowing interactive control of the compromised system. Common reconnaissance commands observed include:
- whoami
- ipconfig /all
- net user /dom
- dsregcmd /status
These commands enable attackers to collect information about users, network settings, domain configurations, and device identity status before conducting further actions.
Conclusion
This campaign demonstrates how threat actors can combine social engineering with legitimate Microsoft Teams and Quick Assist functionality to bypass traditional security assumptions. Once remote access is granted, attackers use signed applications, DLL side-loading, WMI, AWS API Gateway infrastructure, and localhost-based communication to conceal the relationship between the initial loader and the interactive reverse shell.
Organizations should treat unsolicited IT-support requests through external Teams chats with caution and establish policies governing remote-support tools such as Quick Assist. Security teams should monitor for unexpected Quick Assist usage, MSI installations initiated through msiexec.exe, suspicious DLLs loaded from application directories, WMI-created child processes, unusual connections to AWS API Gateway endpoints, and listeners bound to localhost.
Source