Fake Microsoft Teams installers push Oyster malware via malvertising

Hackers have been spotted using SEO poisoning and search engine advertisements to promote fake Microsoft Teams installers that infect Windows devices with the Oyster backdoor, providing initial access to corporate networks. The Oyster malware, also known as Broomstick and CleanUpLoader, is a backdoor that first appeared in mid-2023 and has since been linked to multiple campaigns, with attackers able to remote access infected devices, execute commands, deploy payloads and transfer files.

The campaign is part of a broader pattern where malvertising campaigns impersonate popular IT tools, such as Putty and WinSCP, to lure victims. In this instance, a fake site appears when visitors search for "Teams download" and directs to a site at teams-install[.]top, delivering a file named MSTeamsSetup.exe that is code-signed with certificates from 4th State Oy and NRM NETWORK RISK MANAGEMENT INC.

When run, the installer drops a malicious CaptureService.dll into the user’s Roaming profile and creates a scheduled task named CaptureService to run the DLL every 11 minutes for persistence. The activity mirrors prior fake installer campaigns for Google Chrome and Microsoft Teams that delivered Oyster, highlighting the ongoing abuse of SEO poisoning and malicious advertisements to breach corporate networks, according to Blackpoint SOC.