Fake IT bods on Microsoft Teams coax workers into installing malware

Unit 42 reports a campaign where attackers send phishing emails and then place fake Microsoft Teams IT-support calls to trick employees into granting remote control and installing an MSI that deploys EtherRAT, a Node.js cross-platform remote access trojan that fetches C2 from an Ethereum smart contract. Researchers observed Teams session artifacts (files beginning with "CtrlVirtualCursorWin_*") as a forensic indicator, confirmed cross-tenant OneOnOne chat abuse, and found an open repository containing EtherRAT versions through v9, indicating ongoing development.