Hackers Use Microsoft Teams-Themed Lures to Deploy Legitimate Remote Access Software

An active phishing campaign impersonating Microsoft Teams lures recipients to download seemingly legitimate transcript/recording viewers that silently install a legitimately signed, preconfigured remote access tool (RAT). The malware employs multiple persistence mechanisms (Windows service, SafeBoot registry entries, credential provider/LSA integration, COM inproc server hijacking), sandbox and time-evasion checks, and credential-harvesting capability; attackers host templated landing pages on compromised small-business domains and cloud-hosted platforms, enabling scalable, localized, and resilient delivery.