CYFIRMA Details Teams-Themed Phishing Campaign Using Signed Remote-Access Tool
Summary
CYFIRMA describes a Teams-themed phishing campaign delivering a signed installer for a legitimate remote-access tool. It reports compromised websites and Cloudflare-hosted lures, MSI execution, credential-theft capabilities and layered Windows persistence.
Key points
- Phishing messages impersonate Microsoft Teams notifications and direct victims to fake pages offering transcripts, recordings or document utilities.
- The download is a signed installer for a legitimate remote-access tool configured for unauthorized access; installation uses msiexec.exe, with custom actions invoked through rundll32.exe.
- CYFIRMA reports that the campaign uses compromised business websites alongside attacker-controlled Cloudflare Workers and Pages infrastructure.
- Reported persistence includes an auto-start service, SafeBoot registry entries, credential-provider and LSA authentication-package registration, and COM object registration.
- The installer reportedly uses USB checks, debugger detection, long delays and code obfuscation to hinder analysis.
- The article recommends monitoring for unauthorized remote-access software and persistence changes, restricting installer execution, and strengthening phishing-resistant authentication and endpoint detection.
Article Details
- Attack Vectors
- Microsoft Teams-themed phishing emails or messages link to fake download pages offering a transcript viewer, meeting utility, or document converter.
- Victims are prompted to download and run a signed installer for an unnamed legitimate remote access tool configured for unauthorized access.
- The campaign uses compromised legitimate business websites and attacker-controlled hosting on Cloudflare Workers and Cloudflare Pages for delivery.
- The installer uses an MSI deployment via msiexec.exe and invokes custom actions through rundll32.exe.
- Persistence mechanisms include an auto-start Windows service, SafeBoot registry entry, credential provider and LSA authentication package registration, and COM registration.
- The installer performs USB activity checks, debugger and environment checks, long sleep delays, and code obfuscation.
- Defensive Notes
- Train users to verify unexpected transcript, recording, and document download requests through official collaboration platforms; use email controls to detect malicious links and executable downloads.
- Restrict software installation to authorized administrators and use application allowlisting to limit unauthorized installers.
- Monitor for new auto-start services, SafeBoot registry changes, credential provider and LSA authentication package registration, and COM object registration.
- Use endpoint detection and response to investigate unauthorized remote access software, anti-analysis behavior, and unusual outbound connections from newly installed applications.
- Monitor DNS and proxy traffic for newly observed domains and external remote access infrastructure; correlate phishing detections with endpoint installation events.
- For suspected compromise, isolate affected systems, investigate persistence, reset associated credentials, and verify that persistence mechanisms have been removed.
MITRE ATT&CK
T1120 · Peripheral Device DiscoveryThe installer checks USB bus activity during its anti-analysis checks.T1204.002 · Malicious FileVictims are persuaded to download and run an installer presented as a transcript viewer or meeting utility.T1218.011 · Rundll32The article reports that custom action DLLs are invoked through rundll32.exe during installation.T1219 · Remote Access ToolsThe payload is a legitimate remote access tool configured for unauthorized access.T1497.001 · System ChecksThe installer performs debugger and environment checks to avoid analysis.T1497.003 · Time Based ChecksLong sleep delays are used to bypass time-limited analysis.T1543.003 · Windows ServiceThe installer creates an auto-start Windows service for persistence.T1546.015 · Component Object Model HijackingThe installer creates COM-based persistence by registering a CLSID for InprocServer32.T1547.002 · Authentication PackageThe tool registers an LSA authentication package to persist through the Windows authentication subsystem.T1556 · Modify Authentication ProcessCredential provider and LSA integration are used to capture logon credentials and support pass-through authentication.T1566.002 · Spearphishing LinkTeams-themed phishing emails or messages direct victims to fake download pages.
Vendors
Products
Cloudflare PagesAttack infrastructure combines compromised legitimate business websites with attacker-controlled hosting on Cloudflare Workers and Cloudflare Pages.Cloudflare WorkersAttack infrastructure combines compromised legitimate business websites with attacker-controlled hosting on Cloudflare Workers and Cloudflare Pages.Microsoft TeamsA phishing campaign abuses Microsoft Teams-themed lures to trick victims into downloading a signed remote access tool disguised as transcripts, recordings, or document utilities.
Countries
BrazilGeographic distribution: Global (US, UK, Brazil, Mexico, Turkey, Malaysia, Tanzania, Russia, India, Syria)IndiaGeographic distribution: Global (US, UK, Brazil, Mexico, Turkey, Malaysia, Tanzania, Russia, India, Syria)MalaysiaGeographic distribution: Global (US, UK, Brazil, Mexico, Turkey, Malaysia, Tanzania, Russia, India, Syria)MexicoGeographic distribution: Global (US, UK, Brazil, Mexico, Turkey, Malaysia, Tanzania, Russia, India, Syria)RussiaGeographic distribution: Global (US, UK, Brazil, Mexico, Turkey, Malaysia, Tanzania, Russia, India, Syria)SyriaGeographic distribution: Global (US, UK, Brazil, Mexico, Turkey, Malaysia, Tanzania, Russia, India, Syria)TanzaniaGeographic distribution: Global (US, UK, Brazil, Mexico, Turkey, Malaysia, Tanzania, Russia, India, Syria)TurkeyGeographic distribution: Global (US, UK, Brazil, Mexico, Turkey, Malaysia, Tanzania, Russia, India, Syria)United KingdomGeographic distribution: Global (US, UK, Brazil, Mexico, Turkey, Malaysia, Tanzania, Russia, India, Syria)
Industries
accountingSmall businesses: cafes, pubs, hotels, sports shops, law firms, medical practices, schools, tour companies, motor dealerships, property management firms, accounting consultanciesProperty managementSmall businesses: cafes, pubs, hotels, sports shops, law firms, medical practices, schools, tour companies, motor dealerships, property management firms, accounting consultancies