Cybercriminals Abuse Microsoft Teams Brand To Spread ValleyRAT

Cybercriminals are actively abusing the Microsoft Teams brand to distribute ValleyRAT, a sophisticated malware strain linked to Chinese threat actors.

In mid-April, security researchers discovered fake distribution websites that perfectly mimicked the legitimate Microsoft Teams download page.

These deceptive domains trick unsuspecting users into downloading a trojanized installer disguised as a standard ZIP archive.

The campaign is notable for its exceptionally clean execution chain, blending clever social engineering with staged payload delivery, in-memory decryption, and stealthy persistence mechanisms.

Evidence from the campaign, including Chinese language artifacts and specific registry usage patterns, strongly points to the SilverFox Advanced Persistent Threat (APT) group.

Fake Teams Spread ValleyRAT

The attack begins when victims visit fraudulent domains such as teams-securecall[.]com and are prompted to download a ZIP file. Once extracted, the archive launches a malicious NSIS-based installer that drops multiple hidden components onto the system.

To avoid raising suspicion, it also drops a legitimate Microsoft Teams installer and creates a normal desktop shortcut.

While the user believes a standard installation is occurring, the malware silently initiates a DLL sideloading attack in the background.

It abuses a legitimate executable called GameBox.exe, originally developed by Tencent, to load a malicious file named Utility.dll.

Immediately after execution, the malware moves to neutralize the system’s defenses.

It executes PowerShell commands to add path and process exclusions to Windows Defender, ensuring the malicious working directory and Utility.dll are completely ignored by antivirus scans.

The malware then copies itself to the ProgramData folder and alters its file attributes to remain hidden from casual inspection.

Rather than executing a plain-text virus, the installer drops an AES-encrypted primary shellcode payload. The malware decrypts this file directly in the system’s memory, bypassing the hard drive entirely and evading traditional file-based security tools.

This decrypted loader then allocates memory within the current process and injects the next stage, operating completely out of sight.

To further obscure its actions, the malware uses API hashing to resolve Windows functions dynamically, rather than storing obvious plain-text API names in its code, k7 said.

The final stage of the attack involves contacting a Command and Control (C2) server to download the final payload.

This final package arrives encrypted with a custom XOR operation and contains a fully functional ValleyRAT module.

Because the attackers fetch this payload dynamically, they can easily swap it out to deliver different tools depending on their specific campaign goals.

Once active, ValleyRAT spies on the victim by monitoring the system clipboard to steal sensitive data, such as passwords and cryptocurrency addresses.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.