Rhysida Ransomware Abuses Microsoft Trusted Signing to Deploy OysterLoader Via Teams Malvertising

The Rhysida ransomware gang, previously known as Vice Society, has launched a malvertising campaign that uses Microsoft’s Trusted Signing certificates to deploy OysterLoader, a multi-stage initial access tool, via ads imitating legitimate software such as Microsoft Teams, PuTTY, and Zoom.

According to Expel Threat Intelligence, Rhysida has targeted enterprises for years, with its current campaign active since June 2025, following an earlier run from May to September 2024, and relies on a sophisticated malvertising model that redirects Bing search ads to malicious landing pages. Expel notes that the group uses code-signing certificates to boost stealth, and that Microsoft has revoked over 200 certificates associated with Rhysida’s campaigns, yet the gang continues to abuse the Trusted Signing system.

The core payloads include OysterLoader (also known as Broomstick or CleanUpLoader) and the second stage dropped from Latrodectus, with the operation expanding to deploy multiple malware families simultaneously. Campaigns during May–Sept 2024 yielded seven certificates, while the June 2025–ongoing campaigns have 40+ certificates tracked, highlighting a clear escalation in activity.