Fake Microsoft Teams for Mac delivers Atomic Stealer

July 12, 2024, 6:51 p.m.

Description

A malvertising campaign lures Mac users into downloading a counterfeit Microsoft Teams installer containing Atomic Stealer, a data-stealing malware. The campaign uses advanced filtering techniques, compromised ad accounts, and decoy pages to deliver unique payloads that bypass security measures. Upon installation, the malware steals passwords, files, and exfiltrates data. Mitigations include using browser protection tools and cautious downloading practices.

Date

  • Created: July 12, 2024, 6:21 p.m.
  • Published: July 12, 2024, 6:21 p.m.
  • Modified: July 12, 2024, 6:51 p.m.

Indicators

  • 7120703c25575607c396391964814c0bd10811db47957750e11b97b9f3c36b5d
  • 147.45.43.136
  • http://locallyhyped.com/kurkum/script_66902619887998.92077775.php
  • voipfaqs.com
  • locallyhyped.com
  • teamsbusiness.org

Attack Patterns

  • Atomic Stealer
  • T1139
  • T1025
  • T1555.003
  • T1213
  • T1552
  • T1497
  • T1087
  • T1057
  • T1105
  • T1566.001
  • T1071
  • T1102
  • T1219
  • T1558