Lorem Ipsum Malware: Trojanized MS Teams Installers Deliver…
By Thomas Elkins and Joshua Green
Excerpt
Lorem Ipsum Malware: Trojanized MS Teams Installers Deliver Multi-Stage
Loader and Backdoor
May 4, 2026 | 18 min read
What Happened?
BlueVoyant Security Operations Center (SOC) and Threat Fusion Cell (TFC) security researchers have been tracking an emerging, rapidly maturing threat group conducting a global SEO-poisoning campaign that distributes trojanized Microsoft Teams installers. These installers ultimately deploy a multi-stage shellcode loader and backdoor BlueVoyant has designated Lorem Ipsum. Active since at least February 2026, the campaign opportunistically targets users searching for Microsoft Teams across at least six countries, with a US-…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by BlueVoyant on bluevoyant.com.
Mentioned in the excerpt
More from BlueVoyant1
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
On the same topics
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
- FishMonger’s arsenal upgraded: SprySOCKS for WindowsESET · Added 25 Oct
