Cybercriminals Exploit Microsoft Teams to Phish Login Credentials and Bypass MFA

Iranian state-sponsored threat actors linked to MuddyWater (Seedworm) have been caught hiding behind the Chaos ransomware brand to conduct sophisticated espionage operations, using Microsoft Teams as a phishing vector to steal credentials and manipulate multi-factor authentication (MFA).

Rapid7 researchers uncovered the intrusion in early 2026, revealing a calculated false flag operation designed to mimic financially motivated ransomware attacks while pursuing intelligence-gathering objectives.

Chaos is a ransomware-as-a-service (RaaS) group that emerged in February 2025, shortly after law enforcement disrupted the BlackSuit ransomware infrastructure during Operation Checkmate.

The group is believed to include former members of BlackSuit and Royal ransomware and specializes in big-game hunting (BGH) attacks, demanding ransoms of up to $300,000.

However, in this particular incident, the ransomware branding served as cover for something far more dangerous, a targeted state-sponsored intrusion attributed with moderate confidence to MuddyWater, an Iranian APT affiliated with the Ministry of Intelligence and Security (MOIS).

Cybercriminals Exploit Microsoft Teams

The attack began with targeted social engineering via Microsoft Teams, where the threat actor sent external chat requests to employees. During these interactions, attackers initiated screen-sharing sessions to gain direct visibility into user systems.

Victims were instructed to type their credentials into local text files (credentials.txt, cred.txt) and add attacker-controlled devices to their MFA configurations.

The attackers also directed users to a phishing page at hxxps[://]adm-pulse[.]com/verify.php, which mimicked a Microsoft Quick Assist interface to harvest additional credentials.

After compromising credentials, the threat actors authenticated to internal systems, including a Domain Controller, using multiple hijacked accounts. They established persistent remote access through RDP sessions and deployed DWAgent, a legitimate remote management tool, alongside AnyDesk.

The attackers moved laterally across the network using these trusted tools, deliberately avoiding traditional ransomware encryption, a critical indicator that financial gain was not the primary goal.

Custom Malware: Game.exe RAT

The attackers deployed a multi-stage malware chain. A downloader called ms_upd.exe was fetched via curl from a remote IP and executed on compromised machines.

This dropper then retrieved three components: WebView2Loader.dll (a legitimate DLL), Game.exe (a custom Remote Access Trojan), and an encrypted configuration file (visualwincomp.txt). Game.exe is a custom RAT that impersonates a legitimate Microsoft WebView2 application.

It implements sandbox detection, VM detection, and anti-analysis techniques, including XOR-encoded strings and dynamic API resolution.

The RAT supports 12 commands, including arbitrary command execution, file upload and deletion, and interactive management of PowerShell and cmd.exe shells. It communicates with the C2 server uploadfiler[.]com over port 443.

A critical clue in attribution was a code-signing certificate bearing the name “Donald Gay,” a known shared resource within MuddyWater’s toolkit, previously tied to “Operation Olalampo”, a campaign targeting organizations in the U.S. and MENA regions.

The C2 domain moonzonet[.]com, used by ms_upd.exe, was separately linked to MuddyWater activity in early 2026. Additional attribution indicators include the group’s hallmark use of pythonw.exe for code injection and their established “IT Support” persona on Microsoft Teams.

This pattern echoes a late 2025 incident in which MuddyWater was linked to the Qilin RaaS ecosystem in an attack on an Israeli organization.

The absence of file encryption, despite the presence of Chaos ransomware artifacts, is the most telling behavioral anomaly. Rapid7 assesses that the ransomware component primarily served as an obfuscation mechanism rather than as the primary objective.

The extortion emails and the data-leak site listing were likely designed to divert defenders’ attention from incident recovery. At the same time, the attackers quietly maintained persistence through remote access tools for long-term espionage.

Organizations should treat unsolicited Microsoft Teams messages from external accounts with extreme caution, particularly those requesting screen sharing or credential input.

Defenders should monitor for unexpected deployment of DWAgent, AnyDesk, or similar remote management tools, and watch for unusual RDP activity across domain controllers. MFA configuration changes by non-administrative users should trigger immediate alerts.

This incident is a stark reminder that ransomware indicators alone should not define the scope of an investigation; the full intrusion lifecycle must be examined to uncover the true objective behind an attack.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.