Threat Actors Poisoning SEO Results to Attack Organizations With Fake Microsoft Teams Installer
A recent cyber campaign utilizes search engine optimization (SEO) techniques to disseminate a malicious installer disguised as Microsoft Teams. This campaign, which began in November 2025, targets organizations by leading users to a fraudulent website to…
A recent cyber campaign utilizes search engine optimization (SEO) techniques to disseminate a malicious installer disguised as Microsoft Teams. This campaign, which began in November 2025, targets organizations by leading users to a fraudulent website to download a compromised application deploying the "ValleyRAT" malware.
The malware grants attackers remote access to affected systems, enabling data theft, command execution, and persistent network infiltration. Users searching for Microsoft Teams are redirected to a malicious site via manipulated search results.
The domain teamscn[.]com is specifically crafted to deceive Chinese-speaking users. Security analysts from Reliaquest have identified the threat actors as the Chinese APT group "Silver Fox," who pursue both state-sponsored espionage and financial cybercrime.
The campaign strategically employs a fake Microsoft Teams application to exploit the platform's prevalence in corporate settings, thus increasing infection success rates. Additionally, "false flag" tactics are used to mislead security researchers by incorporating Cyrillic characters and Russian elements in the malware loader, aiming to attribute the attack to Russian actors.
Reliaquest researchers have confidently connected the campaign to "Silver Fox," citing shared infrastructure with prior attacks. This misdirection complicates attribution and delays incident response, granting attackers extended operational time.
A recent cyber campaign utilizes search engine optimization (SEO) techniques to disseminate a malicious installer disguised as Microsoft Teams.
The infection mechanism involves multiple stages designed to bypass security measures and deceive users. The process begins with downloading a ZIP file named MSTчamsSetup.zip , containing a compromised executable, Setup.exe .
Upon execution, Setup.exe performs actions to breach the system. It initially checks for the presence of "360 Total Security," a widely used antivirus in China. Subsequently, a PowerShell command is executed to add exclusions for the C:, D:, E:, and F: drives in Windows Defender, preventing scanning.
powershell.exe -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\, D:\,E:\,F:\
The process continues with executing Verifier.exe , a compromised Microsoft installer presented in Russian, which reads binary data from a Profiler.json file.
To complete the deception, a legitimate version of Microsoft Teams is installed, and a desktop shortcut is created, leading the user to believe the installation was successful while the malware operates covertly in the background.
Based on reporting by Cyber Security News.