Home / Technology / Fake IT Support Scams Target Microsoft Teams
Fake IT Support Scams Target Microsoft Teams
27 Apr
Summary
- New threat group UNC6692 uses spam and fake IT support lures.
- Malware toolkit themed around 'snow' deployed via landing page.
- Compromise involves credential theft and endpoint takeover.
A newly identified threat actor group, dubbed UNC6692, has been observed employing deceptive tactics to compromise victims. The group initiates contact by overwhelming target inboxes with spam, followed by reaching out via Microsoft Teams. Posing as IT support, they offer to resolve the spam issue by directing victims to a malicious landing page.
Upon visiting the page, users are prompted to "authenticate" their email and password, which are then stolen. This initial credential theft is followed by the deployment of a three-part malware framework named after snow-related terms: SnowBelt, SnowGlaze, and SnowBasin. This framework allows for persistent access through browser extensions, data exfiltration via tunneling, and complete endpoint control through a backdoor.
