Security News > 2023 > July > Malware delivery to Microsoft Teams users made easy
A tool that automates the delivery of malware from external attackers to target employees' Microsoft Teams inbox has been released.
TeamsPhisher is a Python-based tool created by US Navy read teamer Alex Reid that allows attackers to deliver attachments to Microsoft Teams users.
TeamsPhisher incorporates Corbridge's and Ellson's technique for manipulating Teams web requests, earlier techniques disclosed by read teamer Andrea Santese, and uses the TeamsEnum Python script to find existing Microsoft Teams users.
"TeamsPhisher requires that users have a Microsoft Business account with a valid Teams and Sharepoint license. This means you will need an AAD tenant and at least one user with a corresponding license. At the time of publication, there are some free trial licenses available in the AAD license center that fulfill the requirements for this tool," Reid explained.
Using the tool is easy: the read teamer / attacker provides the malicious attachment, a message, and a list of target Teams users.
Reid pointed out that organizations can mitigate the risk posed by this vulnerability by managing the options related to external access via the Microsoft Teams admin center.
News URL
https://www.helpnetsecurity.com/2023/07/10/microsoft-teams-malware-delivery/
Related news
- Microsoft Teams tactics, malware connect Black Basta, Cactus ransomware (source)
- Microsoft says attackers use exposed ASP.NET keys to deploy malware (source)
- FINALDRAFT Malware Exploits Microsoft Graph API for Espionage on Windows and Linux (source)
- If you dread a Microsoft Teams invite, just wait until it turns out to be a Russian phish (source)
- Microsoft spots XCSSET macOS malware variant used for crypto theft (source)
- Microsoft Uncovers New XCSSET macOS Malware Variant with Advanced Obfuscation Tactics (source)
- Microsoft's End of Support for Exchange 2016 and 2019: What IT Teams Must Do Now (source)
- New Microsoft 365 outage impacts Teams, causes call failures (source)
- Microsoft admits GitHub hosted malware that infected almost a million devices (source)
- Microsoft: New RAT malware used for crypto theft, reconnaissance (source)