Fake Microsoft Teams Installers Spread Malvertising-Driven Oyster Malware

Quick Takeaways

1. Hackers utilize SEO poisoning and malicious ads to promote fake Microsoft Teams installers, leading to the deployment of the Oyster backdoor malware on Windows devices.
2. The fake installer, resembling legitimate software, is code-signed to appear trustworthy and installs a malicious DLL coupled with scheduled tasks for persistent backdoor access.
3. The Oyster malware, linked to multiple campaigns, facilitates remote control, command execution, and deployment of additional payloads, often abetted by fake IT tool campaigns.
4. Users, especially IT admins, should only download software from verified sources and avoid clicking on malicious search ads to prevent network breaches.

Problem Explained

Recently, cybercriminals have intensified their tactics by using SEO poisoning and malicious search engine advertisements to trick users into downloading fake Microsoft Teams installers. These fake sites, appearing in search results, impersonate legitimate Microsoft download pages but actually direct victims to malicious files labeled “MSTeamsSetup.exe.” When run, this file installs Oyster, a backdoor malware also known as Broomstick, which grants hackers remote access to infected Windows devices. The malware then creates persistent footholds by deploying harmful DLLs and scheduling tasks that reignite the backdoor even after reboots. The attackers often target IT professionals and corporations, knowing they’re more likely to download software with high privileges, making this approach a popular method for breaching corporate networks. The campaign’s execution relies on convincing digital certificates and familiar branding to fool users, highlighting the ongoing risk of trusted software being exploited, and emphasizing the importance for users and IT admins to only download from verified sources and avoid unreliable advertisements.

Reporting this threat, cybersecurity firm Blackpoint SOC notes that this isn’t an isolated tactic but a recurring pattern where sophisticated malicious campaigns leverage trusted brand imagery and search engine manipulation. The fake Microsoft Teams site, although not spoofing Microsoft’s official domain, convincingly mimics the real download experience, making it a potent tool for infiltrating corporate systems. Blackpoint warns that these campaigns are prevalent and sophisticated enough to bypass many traditional security measures, underscoring the need for vigilant browsing practices and strict source verification—especially for IT personnel handling high-privilege accounts—since threat actors are increasingly exploiting user trust and popular search results to establish initial access and launch further malicious operations.

Critical Concerns

Cyber risks continue to escalate as threat actors exploit trusted platforms through SEO poisoning and malvertising campaigns, promoting fake Microsoft Teams installers that infect Windows devices with Oyster malware—also known as Broomstick or CleanUpLoader—granted remote access to compromised systems. These campaigns impersonate legitimate IT tools, leading users to counterfeit websites like teams-install[.]top, which deploy malicious files (e.g., MSTeamsSetup.exe) signed with seemingly legitimate certificates to deceive users. Once executed, the malware drops a persistent DLL, CaptureService.dll, creating scheduled tasks that ensure sustained backdoor access, enabling command execution, payload deployment, and exfiltration. Such tactics not only facilitate initial infiltration but also aid other cybercriminal activities, including deploying ransomware like Rhysida. This persistent threat underscores the critical need for rigorous verification of downloads, cautious clicking on search ads, and heightened awareness of sophisticated social engineering techniques used to exploit user trust and breach corporate defenses.

Possible Remediation Steps

Timely remediation is crucial when dealing with threats like fake Microsoft Teams installers laced with Oyster malware transmitted through malicious advertising. Addressing these issues quickly helps prevent widespread infection, data breaches, and lengthy system downtimes, safeguarding organizational and personal data integrity.

Detection and Identification

• Monitor network traffic for unusual or suspicious activity
• Use antivirus and anti-malware tools with updated signatures
• Conduct regular scans on affected systems

Containment Measures

• Isolate infected devices immediately
• Disable affected accounts or access points to prevent further spread

Removal and Elimination

• Remove malicious files and software using trusted removal tools
• Reset compromised credentials and revoke suspicious access rights

System and Network Cleanup

• Patch and update all relevant software and operating systems
• Clear browser cache, cookies, and history to eliminate malvertising remnants

Prevention Strategies

• Implement robust email filtering and ad-blocking solutions
• Educate users on spotting malicious ads and suspicious links
• Enforce strict software download policies and verify sources before installation

Monitoring and Follow-up

• Continuously monitor for re-infection or related suspicious activities
• Review and improve security protocols to prevent future attacks

Explore More Security Insights

Explore career growth and education via Careers & Learning, or dive into Compliance essentials.

Access world-class cyber research and guidance from IEEE.

Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.

Cyberattacks-V1