Voice Phishing on Microsoft Teams Facilitates DarkGate Malware Attack

Trend Micro analyzed a campaign in which attackers used voice phishing (vishing) via Microsoft Teams to convince a victim to install AnyDesk, gain remote access, and deploy DarkGate (Trojan.AutoIt.DARKGATE.D). The malware used an encrypted AutoIt payload (script.a3x), DLL sideloading, and process injection (e.g., MicrosoftEdgeUpdateCore.exe) to achieve persistence, evade detection, perform system discovery, execute commands, and communicate with a command-and-control server; Trend Micro warns organizations to combine technical controls with user education to mitigate this emerging vector.