Phishing and software impersonation campaigns delivering malware via trusted services

Microsoft reported ongoing OAuth abuse campaigns targeting government and public-sector organizations, where phishing emails lure users into clicking links that leverage legitimate identity-provider redirect behavior (e.g., Microsoft Entra ID and other OAuth providers) to send victims to attacker-controlled pages for malware delivery and potential device takeover. Lures included e-signature requests, Teams meeting recordings, Microsoft 365 password resets, and political themes; Microsoft said it disabled identified malicious OAuth applications but warned related activity persists and requires continued monitoring.

Separately, researchers described multiple deception-based malware delivery operations that rely on impersonation of trusted brands and software rather than exploiting product vulnerabilities. One campaign spoofed Zoom and Google Meet to install the legitimate Teramind monitoring agent for covert surveillance, using fake landing pages and a Microsoft Store lookalike, persistence via services (including tsvchst and pmon), and traffic masking via built-in SOCKS5 proxy support; defenders were advised to check for related drivers (e.g., tm_filter.sys, tmfsdrv2.sys) and artifacts under ProgramData. Another campaign used a lookalike domain (filezilla-project[.]live) to distribute a trojanized portable FileZilla 3.69.5 bundle that adds a malicious DLL for DLL search-order hijacking, enabling credential theft (including saved FTP credentials) and C2 activity—highlighting a broader trend of trusted software impersonation and search/SEO poisoning as an initial access vector.