A sophisticated malicious advertising campaign is actively delivering OysterLoader malware through fake advertisements for popular software tools like PuTTy, Microsoft Teams, and Zoom.
The campaign, which has been running since June 2025, is orchestrated by the notorious Rhysida ransomware gang, a group that has been targeting enterprises since 2021, when they operated under the name Vice Society before rebranding in 2023.
How the Attack Works
Diagram showing the 6 stages of a ransomware attack from reconnaissance to ransom demand
The threat actors exploit a highly effective malvertising model by purchasing advertisements on the Bing search engine that direct unsuspecting users to convincing but malicious landing pages.
When users search for legitimate software, such as PuTTY or Microsoft Teams, these sponsored ads appear prominently in search results, sometimes even showing up directly in the Windows 11 Start menu.
The malicious ads often contain slight misspellings such as “Putty” instead of “PuTTy” to avoid detection while still capturing user clicks.
Once users click these fraudulent advertisements, they are taken to fake download pages that closely mimic official software websites.
These pages deliver OysterLoader, also known as Broomstick and CleanUpLoader, which serves as an initial access tool designed specifically to establish a foothold on victim devices.
The malware’s primary function is to create an entry point that allows a second-stage persistent backdoor to be deployed, enabling hackers to maintain long-term access to compromised systems and networks.
To avoid detection by security software, the Rhysida gang employs two sophisticated techniques.
First, they pack the malware using compression and obfuscation methods that hide its malicious capabilities, resulting in low detection rates when the files are first encountered.
Analysis shows that initially, only five or fewer antivirus engines typically flag the malware, and it can take several days before additional security tools begin detecting it.
Second, the attackers use code-signing certificates to make their malicious files appear trustworthy. These certificates, which are standard for legitimate software, give the malware a false sense of legitimacy in the eyes of Windows operating systems and security tools.
The gang has been particularly brazen in their approach, even abusing Microsoft’s own Trusted Signing service to obtain certificates, despite the service’s built-in protections.
The current campaign represents a dramatic escalation from previous activities.
While the gang’s first Microsoft Teams malvertising campaign, from May to September 2024, utilized seven code-signing certificates, the ongoing 2025 campaign has employed over 40 certificates, indicating a significantly higher operational tempo and resource investment.
Microsoft has reported revoking more than 200 certificates associated with the Rhysida ransomware gang, yet the campaign shows no signs of stopping.
Security researchers have documented 47 unique certificates used to sign OysterLoader across both timeframes, and the gang continues to acquire new certificates as old ones get revoked.
This persistent activity demonstrates the group’s substantial financial resources and commitment to their malicious operations.
The Rhysida gang also diversifies their tactics by simultaneously deploying Latrodectus malware through similar campaigns, ensuring they maintain multiple avenues for initial network access and subsequent ransomware deployment.
Cyber Awareness Month Offer: Upskill With 100+ Premium Cybersecurity Courses From EHA's Diamond Membership: Join Today
%20(1).webp?fit=1068,580&ssl=1&description=The campaign, which has been running since June 2025, is orchestrated by the notorious Rhysida ransomware gang){kind=link}