Rclone

Attackers impersonate IT help desks on Microsoft Teams to gain remote access and abuse certificate services

Microsoft investigated two intrusions in which attackers impersonated help desk staff via Teams chats and calls and got users to approve Quick Assist remote-support sessions. The attackers dropped portable Python, Bun or Java runtimes and staged scripts, then abused weak Active Directory Certificate Services◆ configurations to obtain certificates for privileged accounts. In one case an excluded privileged account was used to exfiltrate files with Rclone to an external SFTP server, and Microsoft Defender◆ blocked over 1,000 subsequent SMB file-access attempts.