Attackers Abuse Microsoft Teams and Quick Assist to Drop Stealthy A0Backdoor

A0Backdoor is a newly identified backdoor used in a targeted social-engineering campaign that leverages Microsoft Teams and Quick Assist to obtain remote access; attackers deliver digitally signed MSI installers that sideload a malicious hostfxr.dll to run encrypted shellcode and establish DNS-based C2 (MX queries and DNS tunneling). The campaign, active from at least August 2025 to February 2026, targets finance and healthcare professionals, uses code-signing certificates and lapsed domains to evade detection, and is linked to threat actors associated with the Black Basta ransomware network.