Fake IT Support Calls on Microsoft Teams Push EtherRAT Malware

Palo Alto Networks' Unit 42 reported a campaign in which threat actors abuse Microsoft Teams voice calls to impersonate corporate IT support staff and trick employees into installing the EtherRAT malware. The goal is initial access to corporate networks.

According to Unit 42's report posted on GitHub, the attack starts with a phishing email using an 'Employee Survey' lure and a malicious PDF attachment. Shortly after the victim opens the document, they receive a Microsoft Teams voice call from an external account impersonating a 'System Administrator.'

Researchers observed the Teams session showing the 'External unfamiliar' label, indicating the caller belonged to a different Microsoft 365 tenant than the recipient. Audit logs showed the attacker initiated the external chat using the account helpdesk@Progressive936.onmicrosoft[.]com while posing as IT support.

After convincing the victim to grant remote control through Microsoft Teams' built-in screen-sharing feature, the attacker walks them through installing legitimate remote-access tools, including HopToDesk and AnyDesk.

With remote access established, the attacker downloads and executes a malicious MSI installer (v7.msi) from camorreado[.]click. The MSI acts as a malware loader: it downloads a legitimate Node.js runtime, decrypts embedded payloads, and ultimately launches EtherRAT.

About EtherRAT

EtherRAT is a cross-platform remote access trojan written in Node.js that gives attackers full control over compromised systems. It can execute commands, manipulate files, steal data, and maintain persistence. Notably, it uses Ethereum smart contracts to retrieve its active command-and-control (C2) server, making the infrastructure harder to disrupt.

Unit 42 notes that EtherRAT was previously used in state-sponsored attacks exploiting the React2Shell vulnerability and has since been adopted by numerous other threat actors. Researchers also found an open directory on a distribution server holding multiple installer versions (v1 through v9), indicating the campaign is under active development.

The campaign follows a growing number of attacks abusing Microsoft Teams to breach corporate networks.

In March, a campaign targeted financial and healthcare organizations by flooding inboxes with spam, then contacting victims over Microsoft Teams while posing as company IT staff. Victims were tricked into launching Quick Assist sessions that led to deployment of the A0Backdoor malware. A month later, Microsoft warned that attackers were increasingly abusing external Microsoft Teams to impersonate helpdesk personnel, obtain remote access, perform reconnaissance, move laterally, and steal data.

To help defend against these attacks, Microsoft has been adding new protections to Teams.

• Earlier this year, Microsoft added warnings that identify external callers and chats to protect against potential phishing and vishing attacks.
• More recently, Microsoft introduced a Teams administrator policy that automatically places suspected third-party bots into the meeting lobby until an organizer manually approves their admission.

Because the campaign relies on social engineering and legitimate tools, layered controls and user awareness matter as much as endpoint detection.

• Restrict or disable external Teams calls and chats where they are not business-critical, and enforce external-caller warnings.
• Train staff that IT support will not cold-call over Teams to request remote control; verify requests through known internal channels.
• Apply application control to block unsanctioned remote-access tools such as HopToDesk and AnyDesk.
• Monitor for unexpected MSI executions and Node.js runtime downloads on endpoints.
• Adopt Microsoft's new Teams policy that sends suspected third-party bots to the meeting lobby.