Scammers Posing as IT Support Distribute EtherRAT Malware via Microsoft Teams

Security researchers have observed a new attack scheme in which threat actors use voice calls on Microsoft Teams to gain initial access to corporate networks.

How the Attackers Operate

The criminals contact company employees through Teams, posing as members of the internal IT support team. Using social engineering techniques, they convince the victim that urgent technical action is required and, under this pretext, prompt them to install malicious software.

The EtherRAT Malware

As a result of such a call, EtherRAT — a remote access trojan — lands on the victim's device. Once installed, it gives the attackers a way to establish a foothold in the company's corporate network, which becomes the launching point for further attacks.

Why the Attack Matters

The use of corporate communication platforms such as Microsoft Teams makes attacks like these especially dangerous: employees are accustomed to trusting internal communication channels and are less likely to suspect deception than they would with email or phone calls from unfamiliar numbers. This allows attackers to bypass traditional filters and anti-phishing systems, which are geared primarily toward email traffic.

Experts recommend that companies train employees to recognize such social engineering attempts and implement additional verification procedures for requests made in the name of IT support, regardless of the communication channel.

Source: Bleeping Computer