Hackers Abuse Cross-Tenant Teams Chat to Deliver EtherRAT Through Malicious MSI Loader

A coordinated social-engineering campaign observed in late June 2026 combined email phishing with an abused Microsoft Teams cross‑tenant chat to deliver a sophisticated EtherRAT implant via a malicious MSI loader.

Initial access began with a targeted email masquerading as internal communication: an “Employee Survey” HTML message containing a PDF lure.

When the victim opened the “EE Survey – How to log on.pdf” in Adobe Acrobat Reader, attackers immediately pivoted to Microsoft Teams, placing a OneOnOne call from an external account displaying as “System Administrator.”

Microsoft Teams logs captured the “External unfamiliar” tag and participant metadata tying the call to an attacker‑controlled Office 365 tenant (helpdesk@Progressive936.onmicrosoft.com).

Artifacts from the user session most notably CtrlVirtualCursorWin_000001E8A159B970 confirm the actor obtained remote control through Teams’ screen‑control feature and actively drove the victim’s machine.

Unit42 Researchers said that, attack demonstrates how threat actors are blending traditional phishing with collaboration‑platform features remote control, chat, and file transfer to escalate access and deploy a blockchain‑anchored command‑and‑control (C2) backdoor.

While controlling the desktop, the actor guided the user to download remote management tools (HopToDesk, AnyDesk), then executed a command prompt to fetch a malicious installer using curl: a file named v7.msi retrieved from camorreado[.]click.

Microsoft Teams Abused

The MSI is not a simple dropper; it’s a multi‑stage JavaScript‑based loader designed for stealth and modular payload delivery.

During installation a CustomAction launches a headless command host which runs a batch script. That script stages a legitimate Node.js runtime (v18.20.5), renames the runtime directory, and invokes an obfuscated JavaScript loader.

Analysis of the loader reveals layered encryption and obfuscation: an initial hex‑encoded blob is decrypted via a subtraction cipher using a 24‑byte key, producing a second‑stage loader that then decrypts an embedded binary through a multi‑step cipher chain.

The final payload is EtherRAT, a bot that resolves its active C2 endpoint from an Ethereum smart contract (0x6e044e19000487c4a6e6af15b4132a5561b5ee1f), with a hardcoded fallback to hxxps[:]//necropatia[.]com.

EtherRAT’s blockchain‑anchored design allows operators to update C2 addresses without modifying binaries, complicating traditional takedown approaches.

Infrastructure tied to the campaign includes an open directory on camorreado[.]click hosting multiple EtherRAT builds (v1–v9), with the repository last updated June 26, 2026.

The implant establishes persistence by writing a Run registry key under Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSetup.

This accessible hosting and the use of legitimate Node.js components indicate an emphasis on operational efficiency and evasion rather than bespoke zero‑day exploitation.

The attack underscores several risk vectors for enterprise defenders. First, collaboration platforms like Microsoft Teams can be leveraged for cross‑tenant social engineering; the “External unfamiliar” label is a vital detection signal but may be overlooked by end users under pressure from an apparent internal IT representative.

Second, remote control features and coerced installation of remote support tools provide an effective hands‑on‑keyboard channel for attackers to execute non‑phishing stages.

Third, blockchain‑anchored C2 mechanisms elevate persistence and resilience against simple URL takedowns.

Mitigations include enforcing strict controls on external Teams contacts (tenant settings and conditional access), monitoring for “give/receive control” events and virtual cursor artifacts, blocking execution of unsigned MSI installers from untrusted domains, and applying runtime protections to detect post‑installation staging of Node.js runtimes.

Incident responders should also investigate ServiceNow and internal ticketing interactions tied to suspicious sessions, and scan endpoints for the specific persistence marker and network calls to the identified smart contract and fallback C2.

IOCs

Field	Value
Domains	camorreado[.]click (malware distribution / open directory hosting EtherRAT v1–v9); necropatia[.]com (fallback C2 domain)
SHA256 hashes	fc2907fa866f86e0821f75060a331ce69ee10ff3aa374587993b17ba5406fa33 (v7.msi); c2eeb74892408496f5a307a5b1fdc92d94fd014ab4252868f04046bf84718ab6 (stage2_payload1.cmd); 94cb54d53927e4ba469099760db531be563a84d716df69e864062d90f0f2448d (stage2_payload2.js); 0cb2f7651d50e1ed1a691e82f0297d49444bdded2461e136cffb156d4f234e52 (stage2_payload3.dat); c16784e2c7b3e3b798addd718850da18f8eb532ab8f352c769a4470d7124805d (stage4_payload1.js); d46b4e8d188fe1773c44d38d730dcb6287639568240c765d9ad4ad79cd239e82 (stage3_payload1.js)
URLs	hxxps[:]//camorreado[.]click/v7.msi (malicious MSI); hxxps[:]//necropatia[.]com (fallback C2)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.