An active phishing campaign that impersonates Microsoft Teams to trick victims into downloading a legitimately signed remote access tool (RAT) preconfigured for unauthorized access.
Attackers deliver Teams-themed lures notifications about meeting transcripts, missed recordings, or “download transcript” prompts linking to convincing landing pages that mimic collaboration and productivity services.
The offered downloads are pitched as transcript viewers, recording utilities, or document converters, but the installers silently deploy a remote administration product with attacker-supplied relay parameters embedded at install time.
Infrastructure analysis shows a dual strategy: compromised small-business websites provide reputational legitimacy (cafes, hotels, law firms, medical practices, schools, tour companies and similar sites across the US, UK, Brazil, Mexico, Turkey, Malaysia, Tanzania, Russia, India, Syria).
While attacker-controlled cloud-hosted platforms Cloudflare Workers and Pages and cheaply registered TLDs such as .icu, .sbs, and .online enable rapid, scalable deployments.
Patterned subdomains and templated pages let operators A/B test lure themes, rotate campaigns, and localize messaging for different departmental targets (HR, Finance, IT, Operations).
Execution is silent and persistent. The delivered MSI runs via msiexec, extracts to temporary locations, invokes custom-action DLLs through rundll32, and registers a system service set to auto-start.
According to CYFIRMA, campaign blends social engineering, reputation abuse, and resilient hosting to maximize success while evading detection.
The installer contains anti-analysis checks USB enumeration to detect sandboxes, debugger-detection routines, long sleep delays, and obfuscated custom-action modules.
Post-installation activity reveals multi-layered persistence: Windows service auto-start, Safe Mode persistence via SafeBoot registry entries, credential provider DLL registration to intercept logon credentials, LSA authentication package integration for deep credential access, and COM InprocServer32 registration enabling process injection or activation.
These mechanisms support long-term footholds, credential harvesting, and resilience against remediation.The phishing link directs victims to a fraudulent landing page styled to resemble a legitimate Microsoft Teams interface.
Temporal and geographic telemetry indicates an actively maintained operation. More than half of identified infrastructure was active within a three- to six-month window, with ongoing scans showing current activity.
The actor has streamlined templates over time recent pages are smaller and likely optimized to reduce detection and improve load performance.
Domain distribution skews heavily to .com (about 64%), reflecting a preference for perceived legitimacy, but country-code TLDs and local compromises suggest either targeted regional lures or opportunistic compromises of local business sites.
From a tradecraft perspective, this campaign exemplifies a shift toward abusing trusted services and legitimate software to bypass signature- and reputation-based defenses.
Compromising legitimate SMB sites provides valuable domain reputation that can help phishing emails access and landing pages bypass filters and browser warnings.
Using serverless and static hosting with established CDNs yields encrypted, high-availability delivery that blends with benign traffic.
Defenders should treat signed installers and reputable domains with caution when delivered via unexpected channels.
MITRE FRAMEWORK
| Tactic | Technique ID | Technique Name |
| Initial Access | T1566.002 | Phishing: Spear phishing Link |
| Execution | T1204.002 | User Execution: Malicious File |
| Persistence | T1543.003 | Create or Modify System Process: Windows Service |
| Persistence | T1547.002 | Boot or Logon Autostart Execution: Authentication Package |
| Persistence | T1546.015 | Event Triggered Execution: Component Object Model Hijacking |
| Credential Access | T1556 | Modify Authentication Process |
| Discovery | T1120 | Peripheral Device Discovery |
| Stealth | T1497.001 | Virtualization/Sandbox Evasion: System Checks |
| Stealth | T1497.003 | Virtualization/Sandbox Evasion: Time Based Evasion |
| Command and control | T1219 | Remote Access Tool |
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…