Sliding into your DMs: Abusing Microsoft Teams for Malware Delivery

This report documents a Microsoft Teams–centric social-engineering campaign where attackers impersonate IT support to coerce victims into installing remote access tools and executing a PowerShell-based multi-stage payload that harvests system information, prompts for credentials, establishes persistence (scheduled tasks or registry autorun), and communicates with AES-encrypted C2 infrastructure; the analysis includes technical details, IOCs (domains, IPs, mutex, crypto constants, user display names), and detection guidance for defenders.