CyberProof Threat Hunters and Intel Analysts are tracking a new wave of SEO poisoning attacks that began in mid-November 2025, abusing search engines to push weaponized Microsoft Teams and Google Meet installers that deliver the Oyster backdoor.
The campaign tricks users into downloading trojanized “office meeting” software from sites that appear legitimate, continuing a broader, long-running trend of malvertising-driven infections.
Oyster, also known as Broomstick or CleanUpLoader, is a malware family first identified by IBM researchers in September 2023.
Over the past two years, it has become a popular tool in the arsenals of financially motivated and ransomware-affiliated threat actors.
In June 2024, Rapid7 researchers documented a malvertising campaign that used Oyster-laced installers with similar file naming conventions but different code-signing certificates.
In July 2025, CyberProof researchers reported Oyster spreading through SEO and malvertising campaigns impersonating widely used IT utilities such as PuTTY and WinSCP.
Subsequent reporting linked Oyster to ransomware groups, including Rhysida, which have leveraged the backdoor as an initial access and persistence mechanism inside corporate environments.
The latest activity shows the same operators, or close copycats, shifting focus to business collaboration tools with far higher mainstream adoption, aiming to maximize infection opportunities among enterprise and remote-work users.
Weaponized Teams and Meet Apps
In September 2025, Blackpoint SOC documented an SEO poisoning and malvertising scheme where searching for “Microsoft Teams download” could lead victims to a fake site hosting a malicious Teams installer.
CyberProof’s analysis of recent samples identified a cluster of binaries mimicking the Microsoft Teams installer as “MSTeamsSetup.exe.”
These files were code-signed with certificates issued to LES LOGICIELS SYSTAMEX INC., lending them apparent legitimacy to users and some security tools.
Additional searches uncovered more malicious binaries signed by LES LOGICIELS SYSTAMEX INC., as well as related samples using certificates tied to Reach First Inc. and S.N. ADVANCED SEWERAGE SOLUTIONS LTD.
By November 2025, independent researchers observed similar behavior for queries targeting Google Meet, with malicious pages serving an Oyster-laced installer using “Google meet” in the file name.
Most of these certificates have now been revoked, but their abuse underscores continuing weaknesses in code-signing trust models and the speed at which threat actors can pivot between new identities and infrastructures.
Oyster Payload and Persistence
Across the reviewed samples, execution of the fake installers resulted in the drop of a malicious DLL named AlphaSecurity.dll into the %APPDATA%\Roaming directory.
To maintain persistence, the installer created a scheduled task named “AlphaSecurity” configured to execute the DLL every 18 minutes, ensuring the backdoor remains active across reboots and user sessions.
Once established, Oyster provides remote access and control capabilities that can enable credential theft, lateral movement, and deployment of secondary payloads, including ransomware.
Given previous associations with high-impact extortion operations, organizations that discover indicators linked to AlphaSecurity.dll or suspiciously signed collaboration-tool installers should treat them as potential precursors to a larger compromise.
Security teams are urged to enforce downloads of collaboration and IT tools exclusively from official vendor domains or managed app stores, scrutinize code-signing chains, monitor for unusual scheduled tasks such as “AlphaSecurity,” and strengthen detection for SEO-poisoning-driven traffic and installer execution across endpoints.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
