Hackers Distribute Malicious Microsoft Teams Build to Steal Remote Access

Cybersecurity researchers have uncovered a campaign in which threat actors use malicious advertisements and search engine optimisation poisoning to distribute fake Microsoft Teams installers containing the Oyster backdoor. The fake installers, masquerading as legitimate Teams software, are distributed to users searching for Teams downloads and are hosted on spoofed sites after deceptive sponsored results, with at least one identified attack domain being teams-install[.]top.

The Oyster backdoor, also known as Broomstick, is deployed by the trojanised installer and uses a DLL named CaptureService.dll placed in a randomly generated folder within the user’s %APPDATA%\\Roaming directory, while a scheduled task named “CaptureService” regularly loads the DLL via rundll32.exe to maintain persistence, according to Blackpoint Cyber.

The campaign’s network activity includes communications with attacker-controlled domains such as nickbush24[.]com and techwisenetwork[.]com, and the backdoor provides remote access, host information collection, command and control, and the ability to deploy additional payloads. Security guidance from the piece includes downloading software only from official vendor domains, using trusted bookmarks, enabling allowlisting to block unsigned installers, and training users against malvertising and SEO poisoning risks.