Threat actors exploit Microsoft Teams calls to distribute EtherRAT malware
Attackers are exploiting Microsoft Teams voice calling to pose as internal IT help desk staff, convincing employees to install a malware strain called EtherRAT that then hands the attackers a foothold inside corporate networks.
The operation, documented by Palo Alto Networks' Unit 42 research team, blends several techniques: phishing emails, fraudulent Teams calls, genuine remote-access software, and a malicious loader built on Node.js — all working together to gain control of a victim's machine.
Per Unit 42's writeup (published on GitHub), the infection chain kicks off with a phishing message disguised as an "Employee Survey" that carries a booby-trapped PDF attachment.
Soon after the victim opens the attachment, they get a Teams voice call from an outside account posing as a "System Administrator." Unit 42 noted that the call carried an "External unfamiliar" tag, signaling the caller was operating from a Microsoft 365 tenant separate from the target's own organization. Log records revealed the attacker's chat originated from the account helpdesk@Progressive936.onmicrosoft[.]com, used to maintain the fake IT-support persona.
Once the victim agrees to hand over remote control through Teams' native screen-sharing function, the attacker walks them through setting up legitimate remote-access applications like HopToDesk and AnyDesk.
With that access secured, the attacker fetches and runs a malicious installer package (v7.msi) hosted at camorreado[.]click. This installer functions as a loader — it pulls down a genuine Node.js runtime, unlocks payloads hidden inside, and finally deploys EtherRAT onto the machine.
EtherRAT itself is a Node.js-based remote access trojan capable of running on multiple platforms, giving its operators complete command over infected devices. Its capabilities include running commands, handling files, exfiltrating information, and staying persistent on the system. Notably, it looks up its command-and-control server through Ethereum smart contracts, a technique that complicates takedown efforts.
This isn't EtherRAT's first appearance — it surfaced earlier in nation-state campaigns that took advantage of the React2Shell flaw, and has since spread to other threat groups beyond its original operators.
Unit 42 also found an exposed directory on one of the attackers' hosting servers containing several installer versions (v1 through v9), suggesting the malware is still being actively refined and updated.
Microsoft Rolls Out New Safeguards After Teams-Based Attacks
This latest incident adds to a broader pattern of threat actors weaponizing Microsoft Teams to infiltrate corporate systems.
Back in March, one such campaign hit organizations in the finance and healthcare sectors, first overwhelming inboxes with junk mail before following up with Teams messages from attackers pretending to be internal IT personnel. Victims were manipulated into starting Quick Assist sessions, which ultimately paved the way for a newly identified malware family, A0Backdoor.
The following month brought a Microsoft advisory warning that threat actors were making growing use of external Teams accounts to impersonate help desk employees, pressuring staff into granting remote device access. Once attackers gained entry, they moved through the network gathering intelligence, jumping between connected devices, and exfiltrating sensitive data.
In response to this pattern of abuse, Microsoft has been rolling out a series of security enhancements for Teams. Earlier in the year, the company introduced alerts that flag calls and chats coming from external accounts, aimed at curbing phishing and vishing attempts. Then just last week, Microsoft launched a new administrative policy that automatically routes suspected bot accounts into the meeting lobby, requiring manual approval from the meeting host before they can join.
