New Vishing Attack Exploits Microsoft Teams and QuickAssist to Deploy .NET Malware
A sophisticated vishing campaign has been identified, leveraging social engineering techniques alongside legitimate Microsoft tools to facilitate command execution chains resulting in the deployment of multi-stage .NET malware.
A sophisticated vishing campaign has been identified, leveraging social engineering techniques alongside legitimate Microsoft tools to facilitate command execution chains resulting in the deployment of multi-stage .NET malware.
The attack begins with threat actors impersonating IT personnel and contacting victims via Microsoft Teams. This process culminates in fileless malware execution using memory-based reflection techniques. Attackers spoof display names in Teams call notifications, posing as Senior IT Staff. Victims receive unexpected calls from what appear to be legitimate IT support personnel.
Using a crafted social engineering narrative, attackers persuade victims to launch Windows Quick Assist, a legitimate remote assistance tool. This action enables attackers to gain remote access, ostensibly for technical support. Shortly after, victims are redirected to a malicious webpage hosted at ciscocyber[.]com/verify.php.
The redirection facilitates the deployment of "updater.exe," a trojanized executable masquerading as a legitimate Windows systems updater. This executable is a .NET Core 8.0 wrapper with an embedded loader designed for non-disk-based execution.
The attack begins with threat actors impersonating IT personnel and contacting victims via Microsoft Teams.
The loader.dll component manages the multi-stage payload delivery. Upon execution, it communicates with command-and-control infrastructure at jysync[.]info to obtain encryption keys. This separated key management complicates detection and analysis.
Using AES-CBC encryption combined with XOR obfuscation, the loader retrieves and decrypts an encrypted payload. The final attack stage exploits .NET reflection to load the decrypted assembly directly into memory, bypassing disk-based detection. The malware operates in memory, executing code with the user's privileges from the initial Quick Assist session.
This campaign exemplifies the convergence of multiple attack vectors, including social engineering and the abuse of legitimate administration tools. The use of trusted applications like Microsoft Teams and Quick Assist reduces user suspicion and circumvents many network-level security measures.
The .NET Core wrapper approach indicates a high level of attacker sophistication and knowledge of modern application mechanisms. Organizations are advised to implement communication monitoring systems to detect impersonation attempts, enforce strict remote assistance policies, and educate users on verifying IT support personnel identity before granting access.
Endpoint detection and response solutions capable of monitoring .NET runtime and process memory injection patterns are essential for detecting this type of fileless malware execution within network environments.
Based on reporting by GBHackers.