Loading malware…
TeamsPhisher is a tool used to distribute malware via Microsoft Teams. Microsoft reporting cited in the provided content states that access brokers associated with the Black Basta ransomware ecosystem used TeamsPhisher to distribute DarkGate through Teams after shifts away from earlier email-based delivery chains such as Qakbot. The content also states that Storm-1674 used Teams to deploy TeamsPhisher and other red teaming tools, injecting DarkGate and other malware. More broadly, the surrounding activity reflects abuse of Teams for social engineering and malware delivery, with Teams used by threat actors for reconnaissance, persistence, data exfiltration, and ransom-note delivery. High-confidence associations in the content link TeamsPhisher specifically to Teams-based malware delivery, especially DarkGate, and to threat activity tracked by Microsoft as Storm-1674 and access brokers operating in the Black Basta ecosystem.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct technique documented for this family, organized by ATT&CK tactic.
A key tactic repeatedly mentioned is leveraging Microsoft Teams as a validation tool for corporate email accounts... Once a target list is refined, the attackers move to the phishing stage, using TeamsPhisher... to send phishing messages via Microsoft Teams while bypassing security controls.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
TeamsPhisher is a tool used to facilitate phishing and payload delivery via Microsoft Teams, often as part of initial access operations.
Tool used to deliver malware (notably DarkGate) via Microsoft Teams as part of initial access/social engineering activity linked to Black Basta access brokers.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.