Loading story…
Attackers have launched a sophisticated malvertising and SEO poisoning campaign to distribute the Oyster backdoor by promoting fake Microsoft Teams installers. The campaign leverages search engine advertisements and manipulated search results for queries like "Teams download," redirecting unsuspecting users to a fraudulent website, teams-install[.]top, which closely mimics the legitimate Microsoft Teams download page. Upon visiting this site, users are prompted to download an installer named "MSTeamsSetup.exe," a filename identical to the official Microsoft Teams installer, increasing the likelihood of deception. The installer is code-signed with certificates from entities such as "4th State Oy" and "NRM NETWORK RISK MANAGEMENT INC," lending further legitimacy to the malicious file. When executed, the installer drops a malicious DLL, CaptureService.dll, into the %APPDATA%\Roaming directory and establishes persistence by creating a scheduled task named "CaptureService" that runs every 11 minutes. This ensures the Oyster backdoor remains active even after system reboots. Oyster, also known as CleanUpLoader and Broomstick, is a commodity backdoor first observed in mid-2023 and has been linked to multiple campaigns, including those supporting ransomware operations like Rhysida. The malware provides attackers with remote access, command execution capabilities, and the ability to deploy additional payloads or exfiltrate files. The campaign's use of SEO poisoning and malvertising mirrors previous tactics used to distribute Oyster via fake installers for other popular IT tools such as PuTTY and WinSCP. Security researchers from Blackpoint SOC identified and analyzed the campaign, highlighting the ongoing abuse of user trust in search results and well-known brands to facilitate initial access to corporate networks. The malicious activity underscores the persistent threat posed by commodity backdoors distributed through deceptive online advertising and the importance of verifying software sources. The campaign does not spoof Microsoft's actual domain but relies on visual mimicry and legitimate-seeming code signatures to bypass user suspicion. The deployment of the Oyster backdoor through this method enables attackers to establish a foothold in targeted environments, potentially leading to further compromise or ransomware deployment. Organizations are advised to educate users about the risks of downloading software from unofficial sources and to implement technical controls to block access to known malicious domains. The incident demonstrates the evolving tactics of threat actors in leveraging trusted brands and digital advertising infrastructure to propagate malware. Security teams should monitor for indicators of compromise related to Oyster and similar backdoors, particularly those delivered via malvertising. The campaign's discovery highlights the need for vigilance in both user behavior and technical defenses against social engineering and software supply chain threats.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
A Sigma rule was published to help defenders detect Oyster malware activity associated with the fake Microsoft Teams installer campaign. The rule represents a new defensive artifact tied to the ongoing malvertising operation.
Blackpoint SOC disclosed that the fake Teams installer was code-signed with certificates tied to "4th State Oy" and "NRM NETWORK RISK MANAGEMENT INC," dropped a malicious CaptureService.dll into %APPDATA%\Roaming, and created a scheduled task for persistence every 11 minutes. The reporting highlighted IT administrators as likely targets and warned users to download software only from verified domains rather than search ads.
Threat actors began using SEO poisoning and search engine ads to lure users searching for "Teams download" to the fake domain teams-install[.]top. The site served a trojanized "MSTeamsSetup.exe" installer that delivered the Oyster backdoor on Windows systems.
Oyster, also known as Broomstick or CleanUpLoader, has been active since mid-2023 and is commonly distributed through malvertising campaigns impersonating popular IT tools. It has also been used as an initial access vector in later ransomware operations, including Rhysida intrusions.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcegithub.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals have launched a widespread campaign targeting users seeking to download Microsoft Teams by distributing fake installers embedded with the Oyster backdoor, also known as Broomstick. Attackers employ a combination of SEO poisoning and malvertising to ensure their malicious download pages appear prominently in search engine results and sponsored ads, increasing the likelihood that unsuspecting users will click on them. Victims who visit these spoofed websites, such as teams-install.top, are tricked into downloading a file named MSTeamsSetup.exe, which is designed to closely mimic the legitimate Teams installer. To further evade detection, the attackers have signed these fake installers with dubious digital certificates issued by companies like 4th State Oy and NRM NETWORK RISK MANAGEMENT INC., making the files appear trustworthy to both users and some security controls. Upon execution, the installer not only launches the real Microsoft Teams application to avoid arousing suspicion but also silently installs the Oyster backdoor in the background. This malware establishes command and control (C2) communications with attacker-controlled servers, such as nickbush24.com and techwisenetwork.com, enabling remote access and persistent control over the compromised system. The Oyster backdoor is highly versatile, allowing threat actors to gather system information, exfiltrate data, and potentially deploy additional payloads. Security researchers from Blackpoint Cyber have been actively monitoring this campaign and have highlighted the sophistication of the attackers' methods, including the use of legitimate-looking certificates and multi-stage delivery techniques. The campaign underscores the growing threat of supply chain and software impersonation attacks, particularly as users increasingly rely on web searches to obtain software. Organizations are advised to educate users about the risks of downloading software from unofficial sources, implement robust endpoint protection, and monitor for suspicious outbound connections indicative of C2 activity. The incident also highlights the importance of verifying digital signatures and scrutinizing the provenance of software installers, as attackers continue to refine their techniques to bypass traditional security measures. This campaign represents a significant escalation in the abuse of trusted brand names and software distribution channels to propagate advanced malware, posing risks to both individual users and enterprise environments. The use of malvertising and SEO manipulation demonstrates the attackers' adaptability and their focus on maximizing the reach and impact of their operations. Security teams should remain vigilant for similar tactics targeting other widely used collaboration and productivity tools.
Jun 29, 2026
Microsoft took decisive action to disrupt a sophisticated ransomware campaign orchestrated by the Vanilla Tempest threat group, also known as VICE SPIDER and Vice Society. The attackers exploited over 200 stolen or misused digital certificates to sign malicious Microsoft Teams installers, making their malware appear legitimate to both users and security software. This campaign, active in late September and early October, targeted users searching for Microsoft Teams updates by leveraging search engine optimization (SEO) poisoning and malvertising. Victims were lured to deceptive domains such as teams-download[.]buzz, teams-install[.]run, and teams-download[.]top, which closely mimicked official Microsoft Teams download sites. Unsuspecting users who downloaded and executed the fake MSTeamsSetup.exe files inadvertently installed a multi-stage payload. The initial loader deployed the Oyster backdoor, a versatile malware tool that Vanilla Tempest has used since June 2025. Once installed, Oyster provided the attackers with remote access, enabling them to steal files, execute arbitrary commands, and deploy additional malicious payloads. The campaign’s technical sophistication was heightened by the use of certificates from reputable providers like Trusted Signing, SSL.com, DigiCert, and GlobalSign, which were fraudulently used to sign the malware. Microsoft’s response involved revoking all compromised certificates, effectively neutralizing the attackers’ ability to distribute signed malware and disrupting ongoing infections. The group’s primary objective was financial gain through data exfiltration and ransomware deployment, with Rhysida ransomware being their recent tool of choice. Previous campaigns by Vanilla Tempest have also used ransomware strains such as BlackCat, Quantum Locker, and Zeppelin, but the current focus has been on Rhysida, particularly targeting sectors like healthcare, education, and manufacturing. The attackers’ use of malvertising and SEO poisoning demonstrates an evolving threat landscape where legitimate-looking software is weaponized to bypass traditional defenses. Microsoft’s intervention not only halted the immediate threat but also highlighted the importance of certificate management and vigilance against supply chain attacks. Security researchers emphasized the need for organizations to verify software sources and monitor for unusual certificate usage. The incident underscores the persistent risk posed by financially motivated ransomware groups and the necessity for coordinated industry responses to disrupt their operations. Organizations are advised to educate users about the dangers of downloading software from unofficial sources and to implement robust endpoint protection measures. The campaign’s exposure and Microsoft’s swift action serve as a warning to both defenders and attackers about the critical role of digital trust in modern cyber operations. This event also illustrates the increasing use of backdoors like Oyster in ransomware campaigns, enabling deeper and more persistent access to victim networks. The disruption of this campaign is a significant blow to Vanilla Tempest’s operations and a reminder of the ongoing arms race between threat actors and defenders.
Jun 29, 2026
Rhysida ransomware operators have leveraged Microsoft's trusted signing system to deliver the OysterLoader malware, bypassing traditional security defenses. The attackers distributed the malware through malicious advertisements, including those targeting Microsoft Teams users, exploiting the trust associated with Microsoft's digital certificates to evade detection. This technique allowed the threat actors to deploy their payloads with a higher likelihood of success, as security solutions often treat signed binaries as legitimate. The campaign involved the use of fake search ads to lure victims and facilitate the download of the malicious loader. By abusing the Microsoft trusted signing process, the attackers were able to slip their malware past endpoint protections, increasing the risk of successful ransomware deployment. Security researchers have highlighted the sophistication of this approach and the need for organizations to scrutinize even digitally signed files, as threat actors continue to find ways to exploit trusted mechanisms for malicious purposes.
Jun 29, 2026