New Vishing Attack Leverages Microsoft Teams Call and QuickAssist to Deploy .NET Malware

A sophisticated vishing campaign leverages spoofed Microsoft Teams calls and Windows QuickAssist to socially engineer victims into executing a .NET Core 8.0 "updater.exe" that loads loader.dll, retrieves keys from jysync.info, downloads and decrypts a payload in memory (fileless execution) and redirects victims to domains such as ciscocyber.com, enabling stealthy C2 communications and evasion of traditional detection.