Fake Microsoft Teams IT Support Calls Deliver EtherRAT via Remote Access Tools

Threat actors are impersonating corporate IT support staff in Microsoft Teams voice calls to trick employees into granting remote access and installing the EtherRAT remote access trojan. The campaign begins with a phishing email themed as an "Employee Survey", then shifts to a Teams call from an external Microsoft 365 tenant, where the caller poses as helpdesk or system administration staff and persuades the target to enable screen sharing and install legitimate remote management tools such as HopToDesk or AnyDesk. Attackers then execute a malicious MSI installer, including samples such as v7.msi, to deploy a multi-stage loader that fetches a legitimate Node.js runtime, decrypts embedded payloads, and launches EtherRAT.

Researchers said EtherRAT is a cross-platform Node.js RAT for Windows, Linux, and macOS that supports command execution, file manipulation, persistence, and data theft. The malware uses Ethereum smart contracts to locate active command-and-control infrastructure, with some reporting also noting a fallback conventional domain, making disruption more difficult. Investigators found multiple installer versions in an open directory, including versions 1 through 9, indicating active development, and identified Teams forensic artifacts such as files beginning with CtrlVirtualCursorWin_* that may show an attacker remotely controlled a victim's desktop during a session. The activity adds to a broader rise in Teams-based impersonation attacks, even as Microsoft rolls out protections such as external caller warnings and stricter handling of suspected third-party bots.