Hackers Distribute Malicious Microsoft Teams Build to Steal Remote Access

Malicious Campaign Using Fake Microsoft Teams Installers

Cybersecurity researchers have identified a campaign where threat actors use malicious advertisements and search engine optimization poisoning to distribute fake Microsoft Teams installers containing the Oyster backdoor malware. The campaign targets users searching for legitimate Microsoft Teams downloads through search engines.

When users search for terms like "teams download," they encounter fraudulent sponsored advertisements that mimic official Microsoft download pages. These malicious ads redirect users to spoofed websites hosting trojanized installers disguised as legitimate Teams software.

One attack domain, teams-install[.]top, served malicious MSTeamsSetup.exe files to unsuspecting users. The fake installers appear authentic and include digital signatures from entities such as "4th State Oy" and "NRM NETWORK RISK MANAGEMENT INC" to bypass basic security checks.

Upon execution, the malicious installer deploys the Oyster backdoor, also known as Broomstick, a modular multistage malware designed for persistent remote access. The malware drops a DLL file named CaptureService.dll into a randomly generated folder within the user's %APPDATA%\Roaming directory.

To maintain persistence, the malware creates a scheduled task called "CaptureService" that regularly executes rundll32.exe to load the malicious DLL. This technique allows the backdoor to blend into normal Windows system activity while maintaining long-term access to compromised systems.

The Oyster backdoor provides attackers with capabilities including remote system access, host information collection, command and control communications, and the deployment of additional payloads. Researchers observed the malware communicating with domains such as nickbush24[.]com and techwisenetwork[.]com.

Organizations can protect themselves by implementing several security measures:

Download software exclusively from official vendor domains rather than search results. Use saved bookmarks for trusted software downloads. Deploy allowlisting controls to block unsigned or untrusted installers. Provide user training on malvertising and SEO poisoning risks.

Security teams should monitor for indicators such as new scheduled tasks named "CaptureService," rundll32.exe processes loading DLLs from suspicious directories, and network communications to newly registered or suspicious domains.

The campaign highlights how threat actors leverage user trust in familiar enterprise software and search engine results to lower infection barriers. Security professionals emphasize the importance of user awareness training and technical controls to combat these increasingly sophisticated social engineering attacks targeting enterprise software downloads.

Based on reporting by GBHackers.