A Teams helpdesk-impersonation campaign installs a Node.js implant (Microsoft detection name: EtherRatz) via a silent MSI, then pivots over WinRM straight to domain controllers and certificate authorities

Microsoft Threat Intelligence documents a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT or helpdesk personnel, pretexts include "Microsoft Security Update," "Spam Filter Update" and "Account Verification," sometimes reinforced with a phone call, and socially engineers the victim into approving a "request control" prompt during a Teams screen-share, or into opening Quick Assist and reading back a connection code (Microsoft Threat Intelligence, 2026-09-02). Once remote control is granted through the legitimate support tool, the operator uses PowerShell inside that same session to silently pull a malicious MSI, disguised with update-themed names and hosted on a widely used cloud-storage platform to blend with legitimate traffic, and installs it via msiexec /qn. The MSI stages a portable Node.js runtime plus a separately encrypted implant file; a deferred MSI custom action launches hidden bootstrap code that decrypts the implant and hands it to Node.js via standard input or a temporary script file, evading controls keyed on unsigned executables or conventional script extensions (Microsoft Threat Intelligence, 2026-09-02). Per-user persistence uses an HKCU Run value or Startup-folder shortcut, both named "EdgeUpdate." The implant polls its command-and-control over randomised HTTPS long-polling and executes returned JavaScript dynamically, performing sandbox and antivirus discovery, periodic screenshot capture, and ADSI-based Active Directory sweeps, enumerating domain-joined servers and harvesting user object and description-attribute content, with randomised sleep jitter to stay quiet. A dormant capability in the analysed implants queries an Ethereum smart contract for an updated command-and-control URL, disabled in the recovered builds, which fall back to a hard-coded server instead (Microsoft Threat Intelligence, 2026-09-02). Microsoft's own Defender detection names for the implant are Trojan:JS/EtherRatz.A!MTB and Trojan:JS/EtherRatz.B!MTB its article does not otherwise name the campaign or the implant. The same detection table names the MSI/loader stage Trojan:JS/SynkLoader.SA and Trojan:Win32/SynkLoader.SA, the family behind a near-identical Teams helpdesk-impersonation chain documented separately on 2026-08-24 (Expel), a detection-level overlap on the loader stage, distinct from the Node.js implant this entry otherwise describes.

The intrusion's most consequential step is lateral movement: operator-issued tasking through the Node.js implant initiates internal WinRM connections on TCP 5985 to a large set of domain-joined systems, explicitly including domain controllers and certificate authorities, activity Microsoft frames as the hallmark of an intrusion that precedes large-scale data theft, extortion or ransomware deployment (Microsoft Threat Intelligence, 2026-09-02). The Node.js/dormant-Ethereum-smart-contract-C2 mechanism overlaps the malware family already tracked as EtherRAT from Red Canary's August monthly round-up, though Microsoft's own reporting never uses that name for this implant; the connection is a mechanistic overlap this entry records, not an identity Microsoft itself asserts.

Triage: an external Microsoft Teams chat or call that leads to a screen-share "request control" approval or a Quick Assist connection-code exchange, particularly one impersonating internal IT, is the point at which this campaign is still stoppable; legitimate internal helpdesk workflows do not typically originate from an external tenant. Downstream, a WinRM connection to a domain controller or certificate authority originating from a non-administrative PowerShell process, or a node.exe process reading a script staged under a user's AppData directory and launched by wscript.exe, are both behaviours normal administrative tooling does not produce.