Microsoft Teams phishing targets employees with A0Backdoor malware

Researchers at BlueVoyant describe a targeted campaign that impersonates corporate IT over Microsoft Teams to convince employees to start Quick Assist sessions and install malicious, digitally signed MSI installers that deploy A0Backdoor via DLL sideloading. The backdoor performs host fingerprinting, sandbox detection, and uses DNS MX queries to exchange encoded C2 data; BlueVoyant links the activity to tactics associated with the BlackBasta operation and reports targets in the financial and healthcare sectors.