Microsoft Teams Social Engineering Abuses Quick Assist to Deploy A0Backdoor

A social-engineering campaign targeting employees at financial and healthcare organizations is abusing Microsoft Teams chats/calls to trick users into granting remote access via Windows Quick Assist, enabling deployment of a newly identified malware family dubbed A0Backdoor. The activity begins with email bombing (flooding inboxes with spam) followed by an attacker impersonating internal IT over Teams, offering help and then persuading the victim to start a Quick Assist session; the tradecraft overlaps with tactics previously attributed to Blitz Brigantine / Storm-1811, which Microsoft has linked to Black Basta-associated operations.

Post-access, the actor deploys digitally signed MSI installers masquerading as Teams-related components and CrossDeviceService (associated with Windows Phone Link), sometimes delivered via tokenized links from Microsoft personal cloud storage to appear trustworthy and hinder collection. BlueVoyant reported the installers drop files into user AppData paths that mimic legitimate Microsoft locations and use DLL sideloading (e.g., a malicious hostfxr.dll) to execute an in-memory loader that decrypts shellcode, performs sandbox checks, and ultimately extracts and runs A0Backdoor (using AES-encrypted payloads and a SHA-256-derived key), with anti-analysis behavior including excessive thread creation intended to disrupt debugging.