Fake Microsoft Teams Installers Deliver Oyster Backdoor

SOCRadar® Cyber Intelligence Inc. reports a campaign in which attackers promote fake Microsoft Teams installers to deploy the Oyster backdoor (also known as Broomstick). The attack chain relies on malvertising and search result poisoning, with victims downloading installers from sites that mimic legitimate downloads.

The Oyster backdoor persists by creating a scheduled task named CaptureService and abusing rundll32.exe to stay active, and it later communicates with attacker-controlled domains such as nickbush24[.]com and teams-install[.]icu. IOCs include specific domains, IP addresses like 185.28.119[.]228, and a set of file hashes associated with the infected installers.

The analysis highlights that this tactic abuses brand trust and global reach, emphasising the need for monitoring for suspicious downloads, unusual scheduled tasks, and non‑official download sources. The piece, published on 6 October 2025, also lists mitigations and remediation steps and maps detections to relevant MITRE ATT&CK techniques.