Quick AssistTool
Quick Assist is a remote assistance tool primarily for Microsoft Windows, although a macOS version also exists. Quick Assist allows for remote screen sharing and, with end user approval, remote control and command execution on the enabling device.From MITRE ATT&CK
Last reported 9 days ago, by GuidePoint Security10 reports
ATT&CK techniques
6 of 61 · each with the sentence it comes from- T1684Social Engineering
“Mapped to ATT&CK Enterprise v19.1 (social engineering sits under T1684 in this version; the former T1656 Impersonation is now T1684.001).”
- T1053.005Scheduled Task
“…anti-sandbox evasion technique.If the -nopersist parameter is not passed on the command-line, persistence is established using scheduled tasks by executing the following command:schtasks.exe /s "localhost" /ru "SYSTEM" /create /f /sc ONSTART /TN \Mozilla\UpdateTask /TR "<…”
- T1219Remote Access Tools
“T1219 Remote Access Tools (AnyDesk, Zoho, Quick Assist)”
- T1566.004Spearphishing Voice
“T1566.004 Spearphishing Voice”
- T1567.002Exfiltration to Cloud Storage
“T1567.002 Exfiltration to Cloud Storage”
- T1005Data from Local System
“T1005 Data from Local System”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
10 reports, newest first · the exact sentence from each-
Behind the Help Desk Call: Insights from the Leaked Chats of an IT-Impersonation Extortion Crew“Alert on the first execution of AnyDesk, Zoho Assist, Syncro, Atera, Splashtop or Quick Assist on partner, executive and assistant endpoints and block execution from removable media.”
-
From Access to Exfiltration: What Defenders Need to Know“From there, the attacker persuades the victim to grant remote access through tools like Microsoft Quick Assist, AnyDesk, or TeamViewer, and the foothold is established.What’s notable is who gets targeted first.”
-
Ransomware Leverage is Growing by the Terabyte: Takeaways from ThreatLabz 2026 Ransomware Report“…am bombing with Microsoft Teams vishing and then steering victims toward legitimate remote support and remote access tooling (such as Quick Assist and in some cases other common remote support utilities).”
-
Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity“In one August 20 incident, Huntress detected a social engineering attack, which started with a user executing Quick Assist, a built-in Windows remote support tool that's frequently abused by threat actors in well-documented tech-support scams.”
-
Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams“The attacker posing as a technician walked the employee through launching built-in Windows tools like Quick Assist or downloading third-party RMM software.”
-
Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor“Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor”
-
The dual-use dilemma: Rethinking detection for remote access tool abuse“… and then follow up with an external Teams Message, getting the user to start a remote access session using the built-in Windows tool Quick Assist.”
-
Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms“…desktop and support sessions using built-in or commercial services, including Zoom, Microsoft Terminal Services, Microsoft Teams, and Quick Assist.”
-
Payouts King Takes Aim at the Ransomware Throne“…acks follow similar techniques, tactics, and procedures (TTPs) as prior attacks such as leveraging spam bombing, Microsoft Teams, and Quick Assist.”
-
Shedding light on the ABYSSWORKER driver“"Attackers Leveraging Microsoft Teams Defaults and Quick Assist for Social Engineering Attacks", January 31 2025.”
Indicators in its reports
named in the reports above- re102.fastwinnow[.]comin 1 report
- 66b2b22397cea219…fc9ca1fabed5in 1 report
- 9136ffb749c6cec1…d74c32578f52in 1 report
- 7dcabb6d07d52b92…56fc1cd2372fin 1 report
- 35ea50f16bd5c080…1ae58db0eedcin 1 report
- 759287052b8cc4f4…3a95092c6f96in 1 report
- f36bfccf944b5d1e…9d43940b1121in 1 report
- 51edd14233483bcf…7ec1bb17ce33in 1 report
- 5d53246b0e6b681b…2e829c053f85in 1 report
- 65af5c3ba2d00967…b907d492a670in 1 report
- 41748648b71a7043…a4f718e7fd91in 1 report
- f85960dee17ba587…c7f0988413f5in 1 report
- scansec-upd[.]comin 1 report
- re2.filesdwnload[.]topin 1 report
- re8.dowlfles[.]onlinein 1 report
- update19.upldf[.]onlinein 1 report
- 5.253.59[.]222in 1 report
- 94.140.114[.]192in 1 report
- 193.29.57[.]37in 1 report
- 45.86.162[.]228in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.