SecuriTricks - microsoft teams

Russian Ruse: ValleyRAT Hits China via Fake Microsoft Teams Attack

The Chinese APT group Silver Fox has launched an SEO poisoning campaign targeting Chinese-speaking users, impersonating Microsoft Teams. The campaign uses a modified ValleyRAT loader with Cyrillic elements to mislead attribution. Silver Fox aims to conduct espionage and financial fraud, posing a si…

apt

espionage

Published: December 10, 2025

Downloadable IOCs: 37

Teams Social Engineering Attack: Threat Actors Impersonate IT to Steal Credentials via Quick Assist

A sophisticated social engineering attack utilizing Microsoft Teams' new 'Chat with Anyone' feature has been uncovered. Threat actors impersonated IT support to trick users into initiating Quick Assist sessions, ultimately leading to credential theft and potential data exfiltration. The attack invo…

Published: December 3, 2025

Downloadable IOCs: 0

Threat Actors Leverage SEO Poisoning and Malicious Ads to Distribute Backdoored Microsoft Teams Installers

A new campaign is distributing the Oyster (Broomstick) backdoor through trojanized Microsoft Teams installers. Threat actors are using SEO poisoning and malvertising to trick users into downloading fake installers from spoofed websites. The malicious installers deploy a persistent backdoor that ena…

Published: October 2, 2025

Downloadable IOCs: 15

From a Teams Call to a Ransomware Threat: Matanbuchus 3.0 MaaS Levels Up

Matanbuchus 3.0, a malware loader available as Malware-as-a-Service, has evolved with significant updates. It now employs sophisticated techniques including improved communication protocols, in-memory stealth capabilities, enhanced obfuscation, and support for WQL queries, CMD, and PowerShell rever…

Published: July 18, 2025

Downloadable IOCs: 11

Two ransomware campaigns tracked using 'email bombing,' Microsoft Teams 'vishing'

Sophos MDR has identified two threat clusters, STAC5143 and STAC5777, utilizing Microsoft Office 365 to gain unauthorized access to organizations. Both groups employ email bombing and fake tech support social engineering via Microsoft Teams to deliver malware. STAC5143 uses Java and Python-based to…

Published: January 21, 2025

Downloadable IOCs: 15

Malvertising Campaign Leads to Execution of Oyster Backdoor

Rapid7 has observed a recent malvertising campaign that lures users into downloading malicious installers for popular software such as Google Chrome and Microsoft Teams.

Published: June 24, 2024

Downloadable IOCs: 13

Tag: microsoft teams

Attack reports

Russian Ruse: ValleyRAT Hits China via Fake Microsoft Teams Attack

Teams Social Engineering Attack: Threat Actors Impersonate IT to Steal Credentials via Quick Assist

Threat Actors Leverage SEO Poisoning and Malicious Ads to Distribute Backdoored Microsoft Teams Installers

From a Teams Call to a Ransomware Threat: Matanbuchus 3.0 MaaS Levels Up

Two ransomware campaigns tracked using 'email bombing,' Microsoft Teams 'vishing'

Malvertising Campaign Leads to Execution of Oyster Backdoor