New Vishing Attack Leverages Microsoft Teams Call and QuickAssist to Deploy .NET Malware
A recent vishing campaign has been identified, utilizing Microsoft Teams calls and QuickAssist to deliver malware. This method combines traditional voice phishing with modern collaboration tools, facilitating the deployment of sophisticated malware.
A recent vishing campaign has been identified, utilizing Microsoft Teams calls and QuickAssist to deliver malware. This method combines traditional voice phishing with modern collaboration tools, facilitating the deployment of sophisticated malware.
The attackers impersonate senior IT staff to create a sense of urgency, initiating a multi-stage infection process. The process begins with a Teams call from an external account using a spoofed display name, appearing as a legitimate internal administrator.
The victim is persuaded to launch Microsoft QuickAssist, a native Windows tool. This approach bypasses many standard security controls that typically flag third-party remote access software. Once access is granted, the attacker proceeds to deploy a malicious payload.
SpiderLabs security analysts have identified this trend, highlighting the shift towards using trusted, built-in system utilities for infiltration.
A recent vishing campaign has been identified, utilizing Microsoft Teams calls and QuickAssist to deliver malware.
Following initial access, the victim is redirected to a malicious domain after approximately ten minutes. This delay likely serves to reduce suspicion before the attack's final stage, where a file masquerading as a legitimate updater is introduced to the system.
The campaign significantly relies on social engineering rather than exploiting software vulnerabilities. The use of a .NET malware wrapper allows attackers to execute code directly in memory, minimizing forensic footprints on the endpoint. This fileless approach complicates traditional incident response efforts, as fewer artifacts are left for investigators to analyze.
Technical Analysis of the Infection Mechanism
The attack's core involves a complex infection chain with a .NET Core 8.0 executable. The malicious file, named updater.exe, acts as a wrapper for an embedded library, loader.dll.
Upon execution, this loader connects to a command-and-control server to retrieve encryption keys necessary for the attack's next stage. The malware then downloads an encrypted payload, which is decrypted using AES-CBC and XOR operations.
Importantly, the decrypted code is not written to disk but loaded directly into system memory via .NET reflection, ensuring a persistent and stealthy compromise.
Based on reporting by Cyber Security News.