Hackers are now abusing hijacked Microsoft Teams accounts and fake IT helpdesk chats to push a new, undocumented version of the Python‑based ModeloRAT into corporate environments.
Instead, they use compromised or newly created Microsoft Teams accounts that impersonate internal IT support and message employees directly, claiming to fix an urgent problem with their device or account.
The social engineering is similar in tone to earlier CrashFix operations, but the “helpdesk” moves from the browser into the chat client, making the lure feel more like a legitimate corporate request.
The operator convinces the victim to run a “diagnostic” PowerShell command copied from the chat window.
In the latest KongTuke activity, attackers no longer rely only on malicious browser extensions or fake CAPTCHA pages to reach victims.
ModeloRAT is now being delivered through hijacked Microsoft Teams accounts impersonating internal IT helpdesk staff.
Once executed, this obfuscated command acts as the new first‑stage loader for ModeloRAT, replacing the earlier clipboard‑based CrashFix command but preserving much of the same logic.
Hackers Hijack Microsoft Teams
The PowerShell command writes a ZIP archive to the user profile, saving it under %APPDATA%, then silently unpacks it.
The archive contains a full portable WinPython environment under %APPDATA%\WPy64-31401, mirroring the tooling seen in earlier KongTuke chains that abused Dropbox‑hosted archives and WinPython‑based loaders.
Once extracted, PowerShell launches pythonw.exe from this directory, ensuring there is no visible console window while the infection continues.
Unlike previous models where a single Python script handled everything, this new branch splits execution into two components: one dedicated to reconnaissance and another focused on command‑and‑control (C2).
The recon script collects detailed host information, including domain membership, processes, services, and network configuration, and prepares structured JSON for exfiltration, consistent with the behavior previously documented for ModeloRAT on domain‑joined machines.
The C2 component then establishes outbound HTTP connections to attacker infrastructure using hard‑coded IP addresses, bypassing domain‑based blocking. In the case we observed, the following IPs were active as C2 endpoints:
- 45[.]61[.]136[.]94.
- 64[.]95[.]10[.]14.
- 64[.]95[.]12[.]238.
- 64[.]95[.]13[.]76.
- 162[.]33[.]179[.]149.
This continues KongTuke’s pattern of favoring raw IP‑based beacons to evade simple domain reputation controls, similar to earlier ModeloRAT deployments that talked directly to IPs on port 80.
ModeloRAT Malware
The ModeloRAT variant in this incident was able to execute without detections from several major endpoint detection and response (EDR) products, and related samples showed zero antivirus hits on VirusTotal at the time of analysis.
This aligns with the family’s existing emphasis on multi‑layer obfuscation, anti‑analysis checks, and adaptive beacon timing, but underscores that signatures and reputation‑based controls have not yet caught up with this iteration.
Persistence has also evolved. Previous reports described ModeloRAT using a Run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, typically masquerading as a benign monitoring or software entry.
In the latest case, that Run‑key persistence is still present but is now paired with a scheduled task using a randomly generated name, increasing resiliency and making cleanup harder if only one mechanism is removed.
The attached process tree view from the investigation shows the chain from explorer.exe into powershell.exe, with a heavily obfuscated command line that reconstructs the payload at runtime, a technique borrowed from the earlier CrashFix command pipeline.
Defenders can disrupt this emerging Teams‑based delivery in several places:
- Tighten Microsoft Teams external access policies and, where possible, restrict or flag chat requests from unknown tenants, especially when they claim to be IT or support.
- Monitor and alert on Dropbox or other cloud‑storage downloads from corporate endpoints when there is no clear business justification, as KongTuke continues to favor these services for staging archives and secondary payloads.
- Hunt for ZIP file creation and extraction under %APPDATA%, particularly when followed by the appearance of WPy64-31401 or other portable Python directories.
- Baseline legitimate pythonw.exe usage and detect executions from user‑writable paths such as AppData, which is a recurring hallmark of ModeloRAT deployments.
- Continuously review Run‑key additions and scheduled task registrations, paying attention to entries that point to pythonw.exe under Roaming or Local AppData with unusual or randomly generated task names.
A more detailed technical breakdown of this Microsoft Teams delivery vector, along with full indicators of compromise and detection content, and will release it in a future write‑up.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
