Fake IT support calls on Microsoft Teams push EtherRAT malware

1. Executive summary

Threat actors are conducting a multi-stage vishing campaign that abuses Microsoft Teams voice calls to impersonate corporate IT support staff, tricking employees into installing the EtherRAT remote access trojan. The attack chain, reported by Palo Alto Unit 42, combines phishing emails, Teams-based social engineering, legitimate remote management tools (HopToDesk, AnyDesk), and a Node.js-based malware loader delivered via a malicious MSI installer. EtherRAT grants attackers full system control, including command execution, file manipulation, data theft, and persistence, while using Ethereum smart contracts for C2 resolution to resist infrastructure takedowns. EMEA financial services organisations relying on Microsoft Teams for external communication face elevated risk of initial access and subsequent network compromise.

2. Regulatory framing

3. Technical analysis & attack chain

Attack chain (confirmed steps)

1. Phishing email delivery. The attacker sends a phishing email containing an "Employee Survey" lure with a malicious PDF attachment.
2. Teams voice call. Shortly after the victim opens the PDF, the attacker initiates a Microsoft Teams voice call from an external account impersonating a "System Administrator." The Teams session displays the "External unfamiliar" label, indicating the caller is from a different Microsoft 365 tenant. Audit logs show the external chat was initiated from helpdesk@Progressive936.onmicrosoft[.]com.
3. Screen-sharing and remote-access-tool installation. The attacker convinces the victim to grant remote control via Teams' built-in screen-sharing feature, then guides them through installing legitimate remote-access tools — HopToDesk and AnyDesk.
4. Malicious MSI execution. Using the established remote access, the attacker downloads and executes a malicious MSI installer (v7.msi) from camorreado[.]click.
5. Loader execution and payload deployment. The MSI acts as a malware loader: it downloads a legitimate Node.js runtime, decrypts embedded payloads, and launches EtherRAT.
6. EtherRAT operation. EtherRAT establishes full remote control, enabling command execution, file manipulation, data theft, and persistence. C2 server resolution is performed via Ethereum smart contracts, making infrastructure disruption significantly harder.

Technical specifics

Initial access vector: Social engineering via phishing email followed by Teams voice call. No CVE exploitation is described for the initial access stage. The attack relies on human interaction and abuse of legitimate collaboration features.

Exploited component/CVE: No specific CVE is identified in the source material for this campaign's initial access. The source references a prior "React2Shell vulnerability" in the context of EtherRAT's history but does not attribute the current campaign to CVE exploitation. No verified reference data was resolved for this item; no CVSS scores, severities, or CISA-KEV exploitation states are available.

Payload — EtherRAT

• Cross-platform remote access trojan written in Node.js.
• Capabilities: command execution, file manipulation, data theft, persistence.
• C2 mechanism: Ethereum smart contracts used to retrieve the active C2 server address, providing resilience against traditional domain/IP takedowns.
• Historical context: previously used in state-sponsored attacks exploiting the React2Shell vulnerability; since adopted by additional threat actors. Attribution to state-sponsored actors is single-sourced (BleepingComputer, citing Unit 42); no MITRE ATT&CK actor profile is available in the verified reference data. Treat attribution as unconfirmed.

Loader mechanism

• Malicious MSI installer (v7.msi) downloaded from camorreado[.]click.
• MSI downloads a legitimate Node.js runtime, decrypts embedded payloads, and launches EtherRAT.
• Unit 42 discovered an open directory on a distribution server containing multiple installer versions (v1 through v9), indicating active development.

Legitimate tools abused

• Microsoft Teams (voice calls, screen sharing, external chat).
• HopToDesk (remote access).
• AnyDesk (remote access).
• Node.js (runtime for EtherRAT execution).

Persistence: EtherRAT maintains persistence; specific persistence mechanism (registry keys, scheduled tasks, services) is not detailed in the source material.

Lateral movement / privilege escalation: Not described in the source material for this specific campaign. A separate April campaign referenced in the source involved reconnaissance and lateral movement post-compromise, but that is a distinct incident.

Data access/exfiltration: EtherRAT has data theft capability; specific exfiltration methods or channels are not detailed.

Observed impact: Full system compromise via remote access trojan. The campaign provides attackers with initial access to corporate networks, enabling subsequent post-exploitation activities.

Confidence caveats

• The primary technical detail is sourced from a Unit 42 report referenced via BleepingComputer. The Unit 42 blog post (corpus-1) was fetched but contains minimal additional detail beyond the BleepingComputer article. Key claims about EtherRAT capabilities, the attack chain, and the Ethereum-based C2 mechanism are single-sourced to Unit 42. Verify before enforcement.
• Attribution of EtherRAT to "state-sponsored attacks" is unconfirmed — no MITRE actor profile is available in the verified reference data.
• No CISA-KEV exploitation state, CVSS score, or CWE classification is available for any component of this campaign.

4. Mitigation & containment

P1 — Within 24 hours

1. Block external Teams calls and chats for non-approved tenants. In the Microsoft Teams admin centre, configure external access policies to restrict or quarantine communications from unfamiliar external tenants. Ensure the "External unfamiliar" warning label is visible to all users (Microsoft enabled this by default earlier this year — verify it is not disabled).
2. Block the known malicious infrastructure at network egress: - Domain: camorreado[.]click — block at DNS resolver, web proxy, and firewall. - Email address: helpdesk@Progressive936.onmicrosoft[.]com — block in mail gateway; search Teams audit logs for any contact from this account.
3. Hunt for HopToDesk and AnyDesk installations on corporate endpoints that are not in the approved software baseline. If found on endpoints not provisioned by IT, isolate the host and investigate: - EDR query: search for process creation events for HopToDesk.exe, AnyDesk.exe, and MSI execution (msiexec.exe with v7.msi or similar). - Review installed software inventory for unapproved remote-access tools.
4. Enable the new Teams admin policy that places suspected third-party bots in the meeting lobby pending manual organiser approval (introduced by Microsoft the week prior to publication).
5. Alert on external Teams calls followed by screen-sharing sessions initiated within a short time window of a user opening a PDF attachment.

P2 — Within 72 hours

1. Search Teams audit logs for external chat/call sessions originating from @onmicrosoft.com domains posing as IT support. Look for sessions that led to screen sharing or file transfer.
2. Block Node.js execution from user-writable directories. If Node.js is not an approved runtime for end-user workstations, restrict execution via AppLocker or Windows Defender Application Control (WDAC): - Block node.exe execution from %APPDATA%, %TEMP%, %LOCALAPPDATA%, and user profile paths.
3. Deploy EDR detection rules for MSI installers executing from user-writable paths that subsequently spawn Node.js processes: - Parent process: msiexec.exe - Child process: node.exe or node in a non-standard path - Network connection to external domains following Node.js launch
4. User awareness briefing. Notify staff that IT support will never request installation of remote-access tools via Teams calls from external accounts. Reinforce that "External unfamiliar" labels on Teams calls indicate non-corporate callers.
5. Review and restrict MSI execution via Group Policy: disable msiexec.exe for non-administrator users where feasible (Computer Configuration > Administrative Templates > Windows Components > Windows Installer > Turn off Windows Installer).

P3 — Within 7 days

1. Conduct a tabletop exercise simulating a Teams-based vishing attack leading to RAT deployment, incorporating the EtherRAT attack chain as the scenario basis.
2. Review DORA Art. 24 resilience testing scope to include social engineering via collaboration platforms as a tested threat scenario.
3. Audit third-party remote-access tool policies. Ensure HopToDesk, AnyDesk, and similar tools are either explicitly approved with configuration baselines or blocked via application control.
4. Implement DNS monitoring for Ethereum-related domains or APIs that could indicate smart-contract-based C2 resolution (e.g., calls to Ethereum RPC endpoints from non-standard processes).
5. Review Teams external access configuration holistically — determine whether external federation is required for business operations and apply tenant allow-lists where possible.

5. Indicators of compromise

email  helpdesk@Progressive936.onmicrosoft[.]com
domain  camorreado[.]click
filename  v7.msi
filename  v1.msi
filename  v2.msi
filename  v3.msi
filename  v4.msi
filename  v5.msi
filename  v6.msi
filename  v8.msi
filename  v9.msi

6. Detection

rule EtherRAT_Loader_MSI_Campaign {
    meta:
        author = "Adverse Trace"
        date = "2026-07-06"
        reference = "https://www.bleepingcomputer.com/news/security/fake-it-support-calls-on-microsoft-teams-push-etherrat-malware/"
        description = "Detects EtherRAT-related artefacts from Teams vishing campaign"
    strings:
        $msi_name = "v7.msi" wide ascii nocase
        $domain = "camorreado" wide ascii nocase
        $email = "Progressive936" wide ascii nocase
        $rat = "EtherRAT" wide ascii nocase
        $survey = "Employee Survey" wide ascii nocase
    condition:
        2 of them
}

title: Suspicious MSI Execution via Remote Access Tool Followed by Node.js Launch
id: AT-2026-07-06-252-001
status: experimental
description: Detects MSI installer execution following HopToDesk or AnyDesk remote session, consistent with EtherRAT delivery chain
author: Adverse Trace
date: 2026/07/06
references:

    - https://www.bleepingcomputer.com/news/security/fake-it-support-calls-on-microsoft-teams-push-etherrat-malware/
logsource:
    product: windows
    category: process_creation
detection:
    selection_rat:
        Image|endswith:

            - '\HopToDesk.exe'
            - '\AnyDesk.exe'
    selection_msi:
        Image|endswith:

            - '\msiexec.exe'
        CommandLine|contains:

            - '.msi'
    selection_node:
        Image|endswith:

            - '\node.exe'
    timeframe: 30m
    condition: selection_rat near selection_msi near selection_node
falsepositives:

    - Legitimate IT remote support sessions using approved tools with MSI deployment
level: high

title: External Teams Caller Impersonating IT Support
id: AT-2026-07-06-252-002
status: experimental
description: Detects Microsoft Teams external chat or call from onmicrosoft.com domain containing helpdesk or admin keywords
author: Adverse Trace
date: 2026/07/06
references:

    - https://www.bleepingcomputer.com/news/security/fake-it-support-calls-on-microsoft-teams-push-etherrat-malware/
logsource:
    product: microsoft_teams
    service: audit
detection:
    selection_external:
        CommunicationType|contains:

            - 'External'
        SenderUpn|endswith:

            - '@onmicrosoft.com'
    selection_keywords:
        SenderDisplayName|contains:

            - 'System Administrator'
            - 'helpdesk'
            - 'IT Support'
            - 'Help Desk'
    condition: selection_external and selection_keywords
falsepositives:

    - Legitimate external IT support vendors using onmicrosoft.com tenants
level: medium

7. Sources

• BleepingComputer — "Fake IT support calls on Microsoft Teams push EtherRAT malware" — https://www.bleepingcomputer.com/news/security/fake-it-support-calls-on-microsoft-teams-push-etherrat-malware/ — 2026-07-06
• Palo Alto Unit 42 — "When 'Hi, This Is IT' Comes Through Microsoft Teams" — https://unit42.paloaltonetworks.com/microsoft-teams-phishing/ — 2026-07-06

8. Adverse Trace position

This campaign represents a credible and active threat to EMEA financial services organisations that permit external Microsoft Teams federation. The attack chain is technically straightforward but operationally effective: it combines social engineering, legitimate tool abuse, and a novel Ethereum-based C2 mechanism that complicates traditional infrastructure blocking. No CVSS score, CISA-KEV exploitation state, or confirmed MITRE actor attribution is available for this item — the technical detail is single-sourced to Unit 42 and should be verified before enforcement. We assess the severity as high for organisations with permissive Teams external access policies and weak controls on unapproved remote-access tools. Adverse Trace will continue monitoring for additional EtherRAT IOCs, Unit 42 follow-up publications, and any CISA-KEV additions related to this campaign. Clients should prioritise P1 containment actions within 24 hours and review Teams external access policies as an immediate control.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.