Teams support scams and malicious extensions widen browser risk

At a glance

What this is: This is a threat pulse about a suspected Teams-based social engineering chain that used a malicious browser extension and scripting to reach reconnaissance activity.

Why it matters: It matters because trusted collaboration tools, browser extensions, and local scripting can bypass the controls many teams still rely on for initial access detection and containment.

Context

The core issue is not the browser extension by itself, but the trust path used to install it. A collaboration tool that users treat as internal and safe can become an access channel when support impersonation, file delivery, and local script execution are chained together.

This is a governance problem as much as a malware problem. Identity teams, SOC teams, and endpoint owners each control part of the path, but the attack succeeds when no single control watches the transition from social engineering to code execution to privilege discovery.

For IAM and NHI practitioners, the important lesson is that initial access is increasingly being staged through legitimate enterprise tools rather than only through email or web phishing. That makes user trust, device execution policy, and administrative discovery part of the same control plane.

Key questions

Q: What fails when users can install browser extensions through trusted collaboration channels?

A: The failure is trust amplification. If Teams or another collaboration tool can be used to persuade users to run scripts or install extensions, then the organisation has allowed social engineering to become code execution. That gap breaks the assumption that internal messaging is low-risk. Strong controls need approval, message-source verification, and endpoint execution governance.

Q: Why do support scams inside collaboration tools increase privilege risk?

A: They move the attacker closer to identity discovery without triggering the same scrutiny as external phishing. Once a user executes attacker-supplied content, the next step is often to map admin groups, directory services, and privileged pathways. That makes the issue not just user deception, but a route into the identity layer that can support escalation.

Q: What signs show that a malicious extension installation is moving toward escalation?

A: Look for a chain that starts with file staging or script execution and is followed by LDAP enumeration, domain administrator discovery, or other directory-service probing. Those signals indicate the attacker is no longer just gaining persistence on the endpoint. They are mapping the environment for a higher-privilege move.

Q: How should teams respond when a collaboration-based support scam is suspected?

A: Contain the endpoint, preserve the execution chain, and review collaboration logs for the original message path, tenant source, and any follow-on user interaction. Then validate whether browser extensions, local scripts, or directory discovery occurred before the host was isolated. The objective is to stop escalation and understand whether identity infrastructure was exposed.

Technical breakdown

How Teams impersonation becomes an initial access path

Attackers abuse trusted collaboration platforms by posing as internal support and using the platform’s normal message flow to lower user suspicion. In this case, the likely entry point was a Microsoft Teams-based IT support scam, which matters because the user experiences it as routine enterprise communication rather than an external attack. Once trust is established, the attacker can direct the user to run a script, open a file, or install an extension. That shifts the problem from mail security to human-assisted execution in a channel defenders often monitor less aggressively.

Practical implication: control external and unverified messaging in collaboration tools as part of initial access prevention.

Why browser extensions and AutoHotKey increase execution risk

Browser extensions extend the user’s trusted execution environment, and scripting tools like AutoHotKey can chain actions quickly with minimal user friction. The article describes an executable landing in OneDrive Downloads, running an AutoHotKey script, and then installing the extension before deleting the staged files. That combination is effective because it obscures the installation sequence and reduces obvious artifacts. Security teams should treat browser extension installation, script execution, and file staging as related execution events rather than isolated endpoint actions.

Practical implication: enforce application allowlisting and restrict scripting-engine execution to narrow business-approved use cases.

Why reconnaissance after installation signals privilege-seeking intent

Once the extension is in place, the host performed reconnaissance to identify domain administrators and enumerate LDAP services. That is a classic move from foothold to target mapping. The attacker is not simply collecting data at random, but looking for privileged pathways and directory services that can support escalation or broader access. LDAP enumeration is especially relevant because it often exposes the shape of the identity environment, including roles, group structures, and administration relationships that can be abused if overexposed.

Practical implication: monitor post-execution discovery activity that targets directory services and privileged identity paths.

Threat narrative

Attacker objective: The attacker appears to have wanted privileged access discovery and a foothold that could support escalation into a wider enterprise compromise.

1. Entry likely began with a Microsoft Teams-based IT support scam that leveraged trusted internal messaging to persuade the user to execute attacker-supplied content.
2. The user received a suspicious executable in OneDrive Downloads, which ran an AutoHotKey script to install the malicious browser extension and then deleted the staging files.
3. After installation, the host performed reconnaissance to identify domain administrators and enumerate LDAP services, indicating intent to locate privileged access paths.
4. The objective was to establish a foothold that could be used for privilege escalation and broader compromise without immediate detection.

Breaches seen in the wild

• Secrets in VS Code extensions 2025: Wiz found 550+ secrets in VS Code extensions, including publishing tokens able to push malicious updates to about 150,000 installs.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Trusted collaboration tools have become an identity-adjacent attack surface. When users treat Microsoft Teams as an internal control plane, social engineering can bypass the scrutiny applied to email and web gateways. The important shift is that initial access is no longer confined to a perimeter channel, which means identity and endpoint teams must govern trust in collaboration workflows as part of the same access model. Practitioners should assume helpdesk impersonation will increasingly target internal messaging rather than external inboxes.

Browser extension governance is now a lifecycle problem, not just a browser-hardening problem. The malicious extension in this case was not a standalone event. It was delivered through a staged execution chain that included a downloaded executable and an AutoHotKey script, which means the control failure was permissive software execution combined with weak extension oversight. Extension delivery trust gap: when an organisation cannot explain how extensions are approved, installed, and removed, attackers can smuggle persistence through everyday user activity. Practitioners should treat extension inventory and approval as a governed lifecycle.

Directory reconnaissance after a local payload is a privilege discovery event. The host’s LDAP enumeration and domain administrator discovery indicate the attacker was mapping the identity structure, not merely operating malware. That matters because many organisations still separate malware detection from identity governance, even though the attacker is already blending the two. This is exactly where IAM, PAM, and SOC telemetry need to converge, because post-install reconnaissance is often the first clear sign that the attacker is seeking elevated access. Practitioners should watch for identity-targeting discovery immediately after suspicious execution.

Attackers increasingly exploit the gap between user approval and machine execution. A user can believe they are helping IT while the endpoint is actually installing an extension, running script logic, and preparing the system for follow-on activity. That gap is where modern social engineering succeeds: the human believes the action is sanctioned, but the device is making the real security decision. Practitioners need governance that covers who may message users, which scripts can run, and which extensions can execute, because those are now linked control points.

SNOWBELT illustrates a broader shift toward trusted-channel delivery of malware. The campaign pattern described here aligns with the trend of using legitimate enterprise collaboration workflows to sidestep traditional phishing scrutiny. That does not replace email risk, but it does mean user-trust controls must expand beyond the inbox. Practitioners should measure whether their detection strategy can identify suspicious support requests, staged file execution, and directory-service discovery before escalation occurs.

What this signals

The practical takeaway for security teams is that collaboration platforms are now part of the initial access perimeter. If users can be convinced to trust a message, the attacker may not need to win the inbox battle at all.

Extension trust gap: organisations that can approve, inventory, and remove browser extensions quickly are in a better position to limit the impact of staged execution chains like this one.

The stronger programme response is to connect collaboration controls, endpoint script policy, and identity telemetry into one response path so that support scams do not become directory reconnaissance.

For practitioners

• Restrict collaboration-tool messaging paths Block or require approval for chats from external or unverified tenants, and monitor for unsolicited IT support claims that ask users to run scripts or install fixes.
• Enforce browser-extension allowlisting Allow only approved Chromium extensions and review any sideloaded or user-installed extension against a documented business need and owner.
• Limit local script execution Disable or tightly restrict AutoHotKey and similar scripting engines on endpoints that do not require them, and log attempts to launch scripted installers.
• Hunt for directory reconnaissance after execution Alert on LDAP enumeration, domain administrator lookups, and other identity-discovery activity that follows suspicious file execution or extension installation.

Key takeaways

• This incident shows how a trusted collaboration channel, a local script, and a browser extension can combine into a workable access chain.
• The observed post-install reconnaissance aimed at domain administrators and LDAP services shows the attacker was searching for privilege pathways, not just persistence.
• Blocking unverified collaboration messages, restricting scripts, and tightening extension governance are the controls most likely to interrupt this pattern.

Key terms

• Browser Extension Abuse: Browser extension abuse occurs when a trusted add-on is used to capture data, alter browser behaviour, or reuse authenticated sessions. In enterprise environments, the risk is not just malware delivery but silent access to cookies, tokens, and page content inside the user’s trusted browser session.
• Collaboration Tool Impersonation: Collaboration tool impersonation is the abuse of trusted messaging platforms to pose as a colleague, partner, or supplier. Attackers mimic branding, timing, and conversation context to lower suspicion and get victims to click links, approve requests, or enter credentials. The trust of the channel becomes the exploit.
• Domain Reconnaissance: Domain reconnaissance is the process of mapping identities, trusts, systems, and permissions inside an Active Directory environment. Attackers use it to understand where privilege exists, which controls are weak, and how to move laterally. In practice, it often precedes persistence, privilege escalation, and ransomware deployment.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.