Hackers Exploit Microsoft Teams to Steal Credentials and Bypass MFA

Iran-linked MuddyWater conducted a covert espionage campaign in early 2026 that masqueraded as Chaos ransomware activity; attackers used Microsoft Teams social engineering to harvest credentials and add attacker-controlled MFA devices, deployed a downloader (ms_upd.exe) and a custom RAT (Game.exe) that communicated with C2 domains, and used legitimate remote management tools and RDP to maintain persistence while avoiding file encryption to conceal true objectives.