Ethical Hacking News
Malicious actors are using fake Microsoft Teams installers to push Oyster malware, also known as Broomstick and CleanUpLoader, via malvertising. This malware provides attackers with remote access to infected devices, allowing them to execute commands, deploy additional payloads, and transfer files. To avoid falling victim to this malicious campaign, users are advised to exercise extreme caution when searching for software downloads online and only download software from verified domains.
Malicious activity on dark web targets users and corporate networks. A fake Microsoft Teams installer is being used to push the Oyster malware (Broomstick and CleanUpLoader). The Oyster malware is a backdoor that provides attackers with remote access to infected devices. The fake installer drops a malicious DLL into the %APPDATA%\Roaming folder, ensuring continuous activity. Threat actors are exploiting user trust in search results and well-known brands to gain initial access to corporate networks. Users should exercise extreme caution when searching for software downloads online and avoid suspicious search engine advertisements. Organizations should implement robust security measures, including network segmentation, intrusion detection systems, and regular software updates.
In recent months, a new wave of malicious activity has been spotted on the dark web, targeting unsuspecting users and corporate networks alike. The culprit behind this malicious campaign is a fake Microsoft Teams installer that has been used to push the Oyster malware, also known as Broomstick and CleanUpLoader, via malvertising.
The Oyster malware is a backdoor that provides attackers with remote access to infected devices, allowing them to execute commands, deploy additional payloads, and transfer files. This malware has been linked to multiple campaigns and has been used in conjunction with ransomware operations, such as Rhysida, to breach corporate networks.
The fake Microsoft Teams installer, which is being promoted through SEO poisoning and search engine advertisements, appears to be legitimate at first glance. However, when downloaded and executed, it drops a malicious DLL named CaptureService.dll into the %APPDATA%\Roaming folder. This DLL is then scheduled to run every 11 minutes, ensuring that the backdoor remains active even on reboots.
This activity is not new to the world of cybersecurity. In recent years, there have been numerous campaigns using fake software installers to push malware into unsuspecting users' systems. However, the use of SEO poisoning and search engine advertisements to promote these malicious campaigns has become increasingly sophisticated.
Threat actors are exploiting user trust in search results and well-known brands to gain initial access to corporate networks. This tactic is particularly effective against IT administrators, who are often targeted for their high privileges and access to sensitive information.
To avoid falling victim to this malicious campaign, users are advised to exercise extreme caution when searching for software downloads online. Only download software from verified domains, and avoid clicking on search engine advertisements that seem suspicious or unfamiliar.
Furthermore, the use of SEO poisoning and malvertising to push malware is a growing threat in the world of cybersecurity. As such, it is essential for organizations to implement robust security measures, including network segmentation, intrusion detection systems, and regular software updates.
In addition, users are encouraged to take proactive steps to protect themselves from this type of malicious activity. This includes using reputable antivirus software, keeping operating systems and applications up to date, and being cautious when interacting with unfamiliar websites or download links.
The use of fake Microsoft Teams installers pushing Oyster malware via malvertising is a concerning development in the world of cybersecurity. As such, it is essential for organizations and individuals alike to be aware of this threat and take steps to protect themselves from its consequences.
Related Information:
https://www.ethicalhackingnews.com/articles/Fake-Microsoft-Teams-Installers-Push-Oyster-Malware-via-Malvertising-A-Growing-Threat-to-Corporate-Networks-ehn.shtml
Published: Sat Sep 27 15:25:43 2025 by llama3.2 3B Q4_K_M
