Loading story…
Threat actors are impersonating corporate IT support staff in Microsoft Teams voice calls to trick employees into granting remote access and installing the EtherRAT remote access trojan. The campaign begins with a phishing email themed as an "Employee Survey", then shifts to a Teams call from an external Microsoft 365 tenant, where the caller poses as helpdesk or system administration staff and persuades the target to enable screen sharing and install legitimate remote management tools such as HopToDesk or AnyDesk. Attackers then execute a malicious MSI installer, including samples such as v7.msi, to deploy a multi-stage loader that fetches a legitimate Node.js runtime, decrypts embedded payloads, and launches EtherRAT.
Researchers said EtherRAT is a cross-platform Node.js RAT for Windows, Linux, and macOS that supports command execution, file manipulation, persistence, and data theft. The malware uses Ethereum smart contracts to locate active command-and-control infrastructure, with some reporting also noting a fallback conventional domain, making disruption more difficult. Investigators found multiple installer versions in an open directory, including versions 1 through 9, indicating active development, and identified Teams forensic artifacts such as files beginning with CtrlVirtualCursorWin_* that may show an attacker remotely controlled a victim's desktop during a session. The activity adds to a broader rise in Teams-based impersonation attacks, even as Microsoft rolls out protections such as external caller warnings and stricter handling of suspected third-party bots.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft added Teams security measures including warnings for external callers and a policy to hold suspected third-party bots in the meeting lobby. The protections were noted in the context of the broader rise in Teams-based intrusion campaigns.
Reporting on the campaign revealed that EtherRAT is a cross-platform Node.js RAT with command execution, file manipulation, persistence, and data theft capabilities, and that it uses Ethereum smart contracts to locate active command-and-control infrastructure. Researchers also identified Teams forensic artifacts such as files beginning with 'CtrlVirtualCursorWin_*' that may indicate attacker control during remote sessions.
Threat actors conducted a social-engineering campaign that began with an 'Employee Survey' phishing lure and escalated to Microsoft Teams calls from external Microsoft 365 tenants impersonating IT support. After gaining trust, the attackers had victims install HopToDesk or AnyDesk and then executed a malicious MSI loader that deployed the Node.js-based EtherRAT malware.
Researchers found an open directory hosting multiple EtherRAT installer versions, indicating the malware and delivery chain were under active development. One reference states the updates in that directory were as recent as June 26.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcetheregister.com
Open sourcecsoonline.com
Open sourcebleepingcomputer.com
Open sourcegithub.com
Open sourcehunters.security
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used **email bombing** and fake IT support messages over **Microsoft Teams** to trick employees into launching **Windows Quick Assist**, giving remote access that led to the deployment of **Nimbus RAT**. eSentire said the campaign targeted corporate organizations globally, with notable impact on the legal sector, and observed a full compromise path from Teams contact to RAT execution in under 20 minutes. In one documented intrusion, the victim received more than 280 legitimate subscription emails before being contacted by an actor-controlled Teams account, then was directed to download malware from a compromised **Microsoft 365** tenant hosted on **SharePoint**. Nimbus RAT is a Java-based backdoor bundled with **OpenJDK** to run on Windows systems and uses **Google Drive** and **Google Sheets** for command-and-control, helping malicious traffic blend into normal SaaS activity. Researchers said the malware supports command execution, file and registry manipulation, screenshot capture, in-memory payload execution, and credential theft, while a secondary tool, **InboxSetupPro**, uses **OneDrive** for exfiltration and steals communications data including **Signal** attachments and large offline email archives. eSentire reported **1,540** similar Teams-related events across **172** customer environments, with activity rising sharply from December 2025 through March 2026, prompting recommendations to restrict external Teams communications, disable Quick Assist where possible, monitor transfers to public cloud storage, and train users to spot email-flooding and fake helpdesk tactics.
Jun 29, 2026
Attackers used **Microsoft Teams** to impersonate IT or helpdesk staff and socially engineer employees into granting access or executing malicious actions, turning collaboration tooling and trusted support workflows into the initial access vector. One report describes a compromise at an Italy-based consumer services company where a Teams meeting invite and screen sharing session led the victim to run a staged **PowerShell** chain that deployed **PhantomBackdoor**, a multi-stage **WebSocket-based** backdoor associated with earlier spear-phishing activity. The observed sequence included post-call PowerShell execution, device reconnaissance, and establishment of WebSocket command-and-control. A second report describes a similar **vishing** intrusion in which a threat actor posing as support staff called employees through Teams and, after multiple attempts, convinced one user to grant remote access through **Quick Assist**. The attacker then directed the victim to a spoofed credential-harvesting site, used a malicious **MSI** and sideloaded **DLL** to launch follow-on payloads, and established outbound C2. While the malware families and exact post-compromise chains differ, both accounts document the same operational pattern: **Teams-based social engineering**, abuse of legitimate remote assistance or user-guided execution, credential theft or payload staging, and transition to hands-on intrusion activity inside a corporate environment.
Jun 29, 2026
A malware campaign is using fake Microsoft Teams download pages promoted on **X** to lure corporate users into installing trojanized ZIP archives that deploy **ValleyRAT**. Researchers said the infection chain relies on an **NSIS** installer and **DLL sideloading** through Tencent’s legitimate `GameBox.exe`, then uses PowerShell to add Windows Defender exclusions, hide files, and establish persistence through unauthorized service creation and registry artifacts including `_CCGDAT`. Once executed, the loader decrypts staged payloads from `user.dat` in memory using **AES** and **XOR**, with additional evasion through API hashing and reflective loading. The final ValleyRAT payload captures keystrokes, clipboard contents, and active-window activity before exfiltrating data to command-and-control infrastructure at `103.215.77.17`; researchers said the campaign shows Chinese-language artifacts and behavioral overlaps that likely tie it to the **SilverFox APT** cluster.
Jun 30, 2026