By impersonating help desk personnel, hackers were able to infiltrate corporate systems.

Over the last year, the public has been trained to view the biggest new wave of emerging cyberthreats as AI-driven. In fact, frontier AI models accelerating the pace of cyberattacks — and even jumping ahead so far that the models have to be paused in the case of Anthropic’s Mythos — have driven the cybersecurity conversation recently.

But a recent report from Microsoft detailing how hackers used its Teams software to infiltrate corporate systems shows that human hackers are still using social engineering scams to fool other humans into doing their dirty work.

According to the report, “threat actors used Microsoft Teams messages and calls to impersonate IT or help desk personnel and socially engineer users into granting interactive remote access, primarily through Quick Assist.” Once they were granted access by unsuspecting workers, the hackers were able to set up software using Python, Bun or Java runtimes, open up networks and grant themselves authentication, giving them free rein over corporate systems.

In order to open the door to all that activity, however, a human had to grant access to the intruder. “Both incidents began with Teams phishing messages and calls that impersonated support personnel,” the report stated. “The social engineering persuaded a user to establish an attacker-controlled remote session, primarily by guiding the user to open Quick Assist and provide the connection code. ” Presumably, the employees who granted access thought the people on the help desks reaching out were just doing their jobs to keep their workplaces safe and operations running smoothly.

Source link