Fake Microsoft Teams installers push Oyster malware via malvertising

**Malicious SEO ads and a fake Microsoft Teams download site are delivering the Oyster backdoor (aka Broomstick/CleanUpLoader) to Windows devices; the trojanized MSTeamsSetup.exe is code-signed, drops CaptureService.dll into %APPDATA%\Roaming, and creates a scheduled task named "CaptureService" to achieve persistence — the backdoor has been observed in multiple campaigns and linked to ransomware operations such as Rhysida.**