Loading story…
Attackers used a mailbombing campaign and Microsoft Teams impersonation to trick an employee into downloading a malicious archive from a fake self-service portal, deploying a modular remote access trojan built on the Deno runtime. Researchers said the malware consisted of four heavily obfuscated JavaScript files—app.js, back.js, helper.js, and webui.js—that split functions across processes using Deno permission flags, established persistence through the HKCU\Run registry key, and communicated with a CloudFront-hosted WebSocket command-and-control endpoint to blend with legitimate traffic.
The intrusion gave operators remote command execution through cmd.exe, used conhost.exe --headless to reduce visibility, and exposed loopback services that enabled TCP tunneling and internal network pivoting from the compromised host. Endpoint protection reportedly did not block the implant or its C2 traffic at launch, and detection came later during reconnaissance activity including LDAP and certificate-related queries, prompting recommendations to monitor Deno execution from user-writable paths, suspicious permission flags, loopback listeners, registry persistence, and correlations between external Teams calls and sudden email floods.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
On June 4, 2026, InfoGuard Labs published a report detailing the intrusion chain, the four-module Deno malware architecture, persistence, command execution, tunneling behavior, and behavioral detection opportunities.
Endpoint protection did not initially block or flag the implant or its command-and-control traffic. Detection occurred later when the attacker conducted reconnaissance activity including LDAP queries and certificate-related queries.
After execution, the malware ran as four obfuscated JavaScript modules on the Deno runtime, used Deno permission flags to separate functions, created persistence via the HKCU Run key, and connected to a CloudFront-hosted WebSocket command-and-control endpoint. It also exposed loopback services for command execution and TCP tunneling to support remote control and pivoting.
Attackers flooded victims with emails and then used an external Microsoft Teams account impersonating internal IT support to socially engineer at least one employee into downloading a malicious archive from a fake self-service portal. The delivered payload was a modular Deno-based remote access trojan and proxy framework.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are impersonating corporate IT support staff in **Microsoft Teams** voice calls to trick employees into granting remote access and installing the **EtherRAT** remote access trojan. The campaign begins with a phishing email themed as an **"Employee Survey"**, then shifts to a Teams call from an external Microsoft 365 tenant, where the caller poses as helpdesk or system administration staff and persuades the target to enable screen sharing and install legitimate remote management tools such as **HopToDesk** or **AnyDesk**. Attackers then execute a malicious MSI installer, including samples such as `v7.msi`, to deploy a multi-stage loader that fetches a legitimate **Node.js** runtime, decrypts embedded payloads, and launches EtherRAT. Researchers said EtherRAT is a cross-platform Node.js RAT for **Windows, Linux, and macOS** that supports command execution, file manipulation, persistence, and data theft. The malware uses **Ethereum smart contracts** to locate active command-and-control infrastructure, with some reporting also noting a fallback conventional domain, making disruption more difficult. Investigators found multiple installer versions in an open directory, including versions 1 through 9, indicating active development, and identified Teams forensic artifacts such as files beginning with `CtrlVirtualCursorWin_*` that may show an attacker remotely controlled a victim's desktop during a session. The activity adds to a broader rise in Teams-based impersonation attacks, even as Microsoft rolls out protections such as external caller warnings and stricter handling of suspected third-party bots.
Jul 7, 2026
Attackers used **email bombing** and fake IT support messages over **Microsoft Teams** to trick employees into launching **Windows Quick Assist**, giving remote access that led to the deployment of **Nimbus RAT**. eSentire said the campaign targeted corporate organizations globally, with notable impact on the legal sector, and observed a full compromise path from Teams contact to RAT execution in under 20 minutes. In one documented intrusion, the victim received more than 280 legitimate subscription emails before being contacted by an actor-controlled Teams account, then was directed to download malware from a compromised **Microsoft 365** tenant hosted on **SharePoint**. Nimbus RAT is a Java-based backdoor bundled with **OpenJDK** to run on Windows systems and uses **Google Drive** and **Google Sheets** for command-and-control, helping malicious traffic blend into normal SaaS activity. Researchers said the malware supports command execution, file and registry manipulation, screenshot capture, in-memory payload execution, and credential theft, while a secondary tool, **InboxSetupPro**, uses **OneDrive** for exfiltration and steals communications data including **Signal** attachments and large offline email archives. eSentire reported **1,540** similar Teams-related events across **172** customer environments, with activity rising sharply from December 2025 through March 2026, prompting recommendations to restrict external Teams communications, disable Quick Assist where possible, monitor transfers to public cloud storage, and train users to spot email-flooding and fake helpdesk tactics.
Jun 29, 2026
Google Threat Intelligence Group and Mandiant disclosed that a newly tracked threat cluster, **UNC6692**, breached enterprise networks by posing as IT help desk staff in Microsoft Teams after first overwhelming targets with high-volume spam emails. Victims were persuaded to accept chats from external Teams accounts and visit a fake **"Mailbox Repair Utility"** or **"Mailbox Repair and Sync Utility"** page, which harvested credentials with a double-entry trick that intentionally rejected the first password submissions before installing malware. The campaign relied on trusted cloud services including **AWS S3** and **Heroku** for payload delivery, command-and-control, and exfiltration, allowing the activity to blend into normal enterprise traffic without exploiting a software vulnerability. After initial access, UNC6692 deployed the modular **SNOW** malware suite, including **SNOWBELT** for browser-extension persistence and command relay, **SNOWGLAZE** for tunneling and proxying, and **SNOWBASIN** for remote command execution, screenshots, and file transfer, alongside AutoHotkey scripts and a portable Python environment. Investigators said the attackers scanned internal networks, used **PsExec** and **RDP** to pivot to a backup server, dumped **LSASS** memory, performed **Pass-the-Hash** against domain controllers, and used **FTK Imager** to steal **`NTDS.dit`** and registry hives before exfiltrating data through LimeWire. Google said the tradecraft resembles social-engineering operations associated with other criminal actors but found no confirmed overlap, and the campaign appears separate from other recently reported Teams-based help desk impersonation activity.
Jun 29, 2026