Loading story…
The KongTuke threat cluster is using Microsoft Teams to breach corporate environments by impersonating internal IT or help-desk staff through fake or hijacked accounts. In observed intrusions, attackers convince employees to paste an obfuscated PowerShell command that retrieves a ZIP archive from Dropbox, leading to deployment of the Python-based ModeloRAT malware. Researchers said the operation can establish persistent access in under five minutes and has used rotating Microsoft 365 tenants plus Unicode whitespace in display names to make attacker-controlled accounts appear legitimate inside Teams conversations.
The updated ModeloRAT variant unpacks a portable WinPython environment in user directories, including AppData and the WPy64-31401 folder, then separates reconnaissance from command-and-control activity while adding stronger evasion and persistence. Reports said the malware had zero detections on VirusTotal at the time of analysis, bypassed several EDR tools, and maintained access through Windows Run registry keys, randomly named scheduled tasks, and in some cases a SYSTEM-level scheduled task that may survive cleanup and reboots. Defenders were urged to restrict or allowlist external Teams federation, monitor Dropbox downloads and ZIP extraction in AppData, detect pythonw.exe launched from user-writable paths, and review new scheduled tasks and registry changes for persistence artifacts.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
On May 14, 2026, reporting based on ReliaQuest research publicly detailed that KongTuke was using fake or hijacked Microsoft Teams accounts, rotating Microsoft 365 tenants, and Unicode whitespace tricks in display names to make messages appear legitimate. The disclosure also noted that attackers could gain persistent access to corporate networks in under five minutes and included indicators of compromise and mitigation guidance.
By May 2026, researchers observed a new ModeloRAT infection chain in which victims paste an obfuscated PowerShell command that downloads a ZIP archive from Dropbox, unpacks a portable WinPython environment in AppData, and launches the malware. The updated variant added stronger evasion, redundant command-and-control and persistence mechanisms, including Run registry keys and randomly named or SYSTEM-level scheduled tasks.
ReliaQuest reported that the KongTuke threat cluster had been using Microsoft Teams since at least April 2026 to impersonate internal IT or help-desk staff and socially engineer employees into running malicious commands. The activity marked the first observed use of a collaboration platform by KongTuke for initial access, expanding beyond its earlier web-based lures.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are impersonating corporate IT support staff in **Microsoft Teams** voice calls to trick employees into granting remote access and installing the **EtherRAT** remote access trojan. The campaign begins with a phishing email themed as an **"Employee Survey"**, then shifts to a Teams call from an external Microsoft 365 tenant, where the caller poses as helpdesk or system administration staff and persuades the target to enable screen sharing and install legitimate remote management tools such as **HopToDesk** or **AnyDesk**. Attackers then execute a malicious MSI installer, including samples such as `v7.msi`, to deploy a multi-stage loader that fetches a legitimate **Node.js** runtime, decrypts embedded payloads, and launches EtherRAT. Researchers said EtherRAT is a cross-platform Node.js RAT for **Windows, Linux, and macOS** that supports command execution, file manipulation, persistence, and data theft. The malware uses **Ethereum smart contracts** to locate active command-and-control infrastructure, with some reporting also noting a fallback conventional domain, making disruption more difficult. Investigators found multiple installer versions in an open directory, including versions 1 through 9, indicating active development, and identified Teams forensic artifacts such as files beginning with `CtrlVirtualCursorWin_*` that may show an attacker remotely controlled a victim's desktop during a session. The activity adds to a broader rise in Teams-based impersonation attacks, even as Microsoft rolls out protections such as external caller warnings and stricter handling of suspected third-party bots.
Jul 7, 2026
A malware campaign is using fake Microsoft Teams download pages promoted on **X** to lure corporate users into installing trojanized ZIP archives that deploy **ValleyRAT**. Researchers said the infection chain relies on an **NSIS** installer and **DLL sideloading** through Tencent’s legitimate `GameBox.exe`, then uses PowerShell to add Windows Defender exclusions, hide files, and establish persistence through unauthorized service creation and registry artifacts including `_CCGDAT`. Once executed, the loader decrypts staged payloads from `user.dat` in memory using **AES** and **XOR**, with additional evasion through API hashing and reflective loading. The final ValleyRAT payload captures keystrokes, clipboard contents, and active-window activity before exfiltrating data to command-and-control infrastructure at `103.215.77.17`; researchers said the campaign shows Chinese-language artifacts and behavioral overlaps that likely tie it to the **SilverFox APT** cluster.
Jun 30, 2026
Attackers used **email bombing** and fake IT support messages over **Microsoft Teams** to trick employees into launching **Windows Quick Assist**, giving remote access that led to the deployment of **Nimbus RAT**. eSentire said the campaign targeted corporate organizations globally, with notable impact on the legal sector, and observed a full compromise path from Teams contact to RAT execution in under 20 minutes. In one documented intrusion, the victim received more than 280 legitimate subscription emails before being contacted by an actor-controlled Teams account, then was directed to download malware from a compromised **Microsoft 365** tenant hosted on **SharePoint**. Nimbus RAT is a Java-based backdoor bundled with **OpenJDK** to run on Windows systems and uses **Google Drive** and **Google Sheets** for command-and-control, helping malicious traffic blend into normal SaaS activity. Researchers said the malware supports command execution, file and registry manipulation, screenshot capture, in-memory payload execution, and credential theft, while a secondary tool, **InboxSetupPro**, uses **OneDrive** for exfiltration and steals communications data including **Signal** attachments and large offline email archives. eSentire reported **1,540** similar Teams-related events across **172** customer environments, with activity rising sharply from December 2025 through March 2026, prompting recommendations to restrict external Teams communications, disable Quick Assist where possible, monitor transfers to public cloud storage, and train users to spot email-flooding and fake helpdesk tactics.
Jun 29, 2026