A new multi-stage vishing campaign has been uncovered that uses Microsoft Teams calls and the QuickAssist tool to deliver fileless .NET malware.
The attack begins when the victim receives a Teams call from a threat actor impersonating a senior IT staff member via a spoofed display name.
Using social engineering, the attacker persuades the user to launch QuickAssist, thereby granting remote access to the device under the guise of a legitimate support request.
Within approximately ten minutes of the session, the victim is redirected to a fake verification page hosted at ciscocyber[.]com/verify.php, which delivers a malicious file named “updater.exe” disguised as a harmless software updater.
Researchers from Trustwave SpiderLabs and LevelBlue report that the executable is not an ordinary dropper but a sophisticated .NET Core 8.0 wrapper containing an embedded module named “loader.dll.”
This loader connects to the external domain jysync[.]info to download encryption keys, retrieve an encrypted payload, and decrypt it using a combination of AES-CBC and XOR algorithms.
The decrypted code is then executed directly in memory via .NET reflection, enabling a fully fileless infection chain that evades endpoint detection mechanisms.
Technical Details and Threat Indicators
Analysis of the binary revealed internal debug strings pointing to Microsoft’s build infrastructure, such as D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb, suggesting the malware author may have repurposed legitimate .NET components.
The campaign’s payloads are linked to two SHA-256 hashes: 2d751f48376c777dd76090130740cfd04693b3da12d03e94e3e6514e864410fc and 7d29bf061719dc442dc00f670768d7a52a70c029678bd67a07b17317ffbd8c69, which help identify infected systems.
Both associated domains, ciscocyber[.]com and jysync[.]info currently returns 404 responses, but may still be active or subject to reactivation by attackers.
This attack demonstrates how cybercriminals are combining social engineering with advanced technical manipulation to bypass modern security controls.
By exploiting trusted collaboration tools such as Microsoft Teams and legitimate utilities like QuickAssist, attackers can seize control of endpoints and deliver memory-only malware that leaves minimal forensic traces.
Security experts recommend disabling QuickAssist where possible, implementing strict verification for IT-related communications, and monitoring outbound connections for anomalies tied to known malicious infrastructure.
The campaign underscores an evolving threat pattern in which attackers increasingly blend psychological deception with technical depth, making vishing-based intrusions among the most challenging attack vectors to detect and contain within enterprise environments.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
