Hackers Exploit Weaponized Microsoft Teams Installer to Deploy Oyster Malware

A sophisticated malvertising campaign has been targeting organisations through a weaponized Microsoft Teams installer that delivers the Oyster malware, according to a recent investigation by cybersecurity experts. The attackers employ a multi‑stage chain beginning with malvertising that surfaces in search results for Teams, redirecting victims from Bing to malicious infrastructure hosted on Cloudflare and secured with a Google Trust Services SSL certificate.

The malicious MSTeamsSetup.exe was signed with a short‑lived certificate from “KUTTANADAN CREATIONS INC.”, with the certificate lifespan lasting only two days, a pattern aimed at evading signature‑based security controls. The Oyster backdoor, also known as Broomstick or CleanUpLoader, is capable of persistent access and data exfiltration, and the campaign attempted to establish C2 with nickbush24[.]com after execution, a connection Microsoft Defender’s ASR rules blocked.

Victims were redirected from legitimate searches in just 11 seconds, and researchers noted living‑off‑the‑land techniques such as cleanmgr.exe creating DismHost.exe in temporary folders. Indicators of compromise include domains such as teams-install[.]icu and team.frywow[.]com, and the file MSTeamsSetup.exe.