Microsoft Teams Vishing Campaign Deploys Nimbus RAT via Quick Assist and Cloud Services

Attackers used email bombing and fake IT support messages over Microsoft Teams to trick employees into launching Windows Quick Assist, giving remote access that led to the deployment of Nimbus RAT. eSentire said the campaign targeted corporate organizations globally, with notable impact on the legal sector, and observed a full compromise path from Teams contact to RAT execution in under 20 minutes. In one documented intrusion, the victim received more than 280 legitimate subscription emails before being contacted by an actor-controlled Teams account, then was directed to download malware from a compromised Microsoft 365 tenant hosted on SharePoint.

Nimbus RAT is a Java-based backdoor bundled with OpenJDK to run on Windows systems and uses Google Drive and Google Sheets for command-and-control, helping malicious traffic blend into normal SaaS activity. Researchers said the malware supports command execution, file and registry manipulation, screenshot capture, in-memory payload execution, and credential theft, while a secondary tool, InboxSetupPro, uses OneDrive for exfiltration and steals communications data including Signal attachments and large offline email archives. eSentire reported 1,540 similar Teams-related events across 172 customer environments, with activity rising sharply from December 2025 through March 2026, prompting recommendations to restrict external Teams communications, disable Quick Assist where possible, monitor transfers to public cloud storage, and train users to spot email-flooding and fake helpdesk tactics.