Microsoft Teams Vishing Spreads DarkGate RAT

Trend Micro researchers observed a multistage vishing campaign in which attackers used a Microsoft Teams voice call and social engineering to persuade a user to install AnyDesk after a Microsoft Remote Support install failed; the adversary then established a C2 channel and deployed DarkGate via an AutoIt-based dropper. DarkGate provides remote control, credential theft, keylogging, RDP/AnyDesk abuse, persistence, and can deliver additional payloads; the infection was halted before data exfiltration. The report highlights vishing as an emerging delivery vector and recommends employee training, vendor verification, whitelisting remote-access tools, and MFA.