Since the Covid pandemic, Microsoft Teams has become part of normal working life.
Staff meetings. Supplier calls. Screen sharing. File sharing. Quick chats. IT support. Customer conversations etc.
It feels familiar and that is exactly why criminals are interested in it.
Three recent examples show the same pattern from different angles.
Symantec’s Threat Hunter Team has reported a DragonForce ransomware attack where a new backdoor, called Backdoor.Turn, used Microsoft Teams relay infrastructure to help hide command-and-control traffic. In plain English, the malware tried to make its traffic look like normal Teams activity. Symantec says Backdoor.Turn is the first known malware to abuse Microsoft Teams TURN relay servers in this way.
Huntress has also covered the axios npm compromise, where attackers used a fake Slack workspace and a scheduled Microsoft Teams call to build trust with a software maintainer before convincing them to install malware.
Blackpoint Cyber has reported another angle: fake Microsoft Teams downloads. Attackers used search engine poisoning and malicious adverts to push people towards spoofed Teams download pages. Instead of the real Teams client, victims were offered a malicious installer that deployed a backdoor.
Different attacks. Same idea – use trusted platforms to make dangerous activity look normal.
This is not a “Teams is bad” story
Microsoft Teams is not the villain here.
The issue is trust.
Most businesses trust Microsoft 365. They trust Teams. They trust meeting invites. They trust familiar branding. They trust a screen that looks like something they have seen a hundred times before.
Attackers know that.
That trust can be abused in three ways.
The first is human trust.
A fake meeting invite.
A convincing Teams call.
A fake update prompt.
A helpful-sounding person saying, “You just need to install this.”
The second is technical trust.
Traffic going to Microsoft infrastructure.
Connections that look normal.
Domains that are usually allowed.
Security tools that see “Microsoft” and do not immediately panic.
The third is brand trust.
A search result that says Microsoft Teams.
An advert that looks official.
A download page with familiar colours and logos.
A file called something like Teams setup.
The danger is assuming anything connected to Teams must be safe.
It might be a real Teams meeting.
It might be a fake support call.
It might be malware hiding behind Teams traffic.
It might be a fake Teams download page waiting for someone who just searched “download Teams”.
What happened in the Symantec report?
According to Symantec, attackers linked to DragonForce ransomware used a Go-based remote access Trojan called Backdoor.Turn during an attack on a major US services firm.
The attack reportedly began in December 2025. Symantec says the attackers may have remained undetected for up to two months before the ransomware was deployed.
Backdoor.Turn did not just connect directly to an obvious attacker-controlled server. It used Microsoft Teams TURN relay servers to help disguise its command-and-control traffic.
TURN relay servers are normally used to help voice, video and meeting traffic connect when direct connections are difficult.
That makes this technique awkward for defenders.
A firewall or monitoring tool may only see traffic going to legitimate Microsoft services.
To the business, it can look like Teams being Teams.
In reality, it may be malware keeping a hidden line open.
What happened in the Huntress story?
The Huntress blog is a good example of how attackers use trust before the malware ever runs.
In the axios npm supply chain compromise, attackers targeted the package maintainer.
According to the Huntress write-up, the attacker first approached the maintainer while pretending to be the founder of a company. They then sent an invite to a fake Slack workspace with realistic branding, channels, team members and posts.
After that, they invited the maintainer to a scheduled Microsoft Teams call.
During the call, the attacker claimed something on the victim’s system was out of date and prompted them to install something.
That install led to a remote access Trojan.
That is the bit businesses should pay attention to.
The attack did not start with a laughably bad email.
It started with something that looked like work.
A conversation.
A workspace.
A Teams call.
A software update.
A person who sounded helpful.
That is why security awareness training needs to feel real.
Not just “watch out for spelling mistakes”.
Modern attacks often have good branding, believable timing and a decent backstory.
What about fake Microsoft Teams downloads?
This is the third part of the story, and it may be the easiest one for small businesses to understand.
Someone needs Teams.
Maybe they are setting up a new laptop.
Maybe they are joining a supplier meeting.
Maybe Teams has stopped working.
Maybe they are using a personal device for a work call.
Maybe they just search “download Teams”.
That is where criminals can step in.
Security researchers have seen attackers use search engine poisoning and malicious adverts to push fake Teams download pages. These pages can look close enough to the real thing that a busy person may not notice.
The victim thinks they are downloading Microsoft Teams.
They are actually downloading malware.
In one reported campaign, the fake installer used the name MSTeamsSetup.exe and delivered a backdoor called Oyster, also known as Broomstick. That backdoor can give attackers remote access, collect information about the machine and help deliver further malicious payloads.
This matters because it does not feel like a cyber attack.
It feels like installing a normal work app.
That is the point.
Attackers do not always need to break in through a clever vulnerability. Sometimes they just wait for someone to download the wrong “official” looking file.
Why this matters for small businesses
Small businesses often run on trust.
You trust suppliers.
You trust Microsoft 365.
You trust staff to get on with their work.
You trust that if something looks normal, it probably is.
That is completely understandable.
It is also what criminals exploit.
A member of staff might receive a Teams invite from what appears to be a supplier.
A finance manager might join a call with someone claiming to be from an IT provider.
A developer might be asked to install a tool during a meeting.
A director might approve access because the request looks like a normal Microsoft login.
A staff member might search for Teams and click the first sponsored result.
A device might send traffic to Microsoft services, so no one thinks twice.
It only requires the attack to blend into the working day for someone to fall for it.
The simple version
Here is the simplest way to explain it to staff:
Criminals are abusing the tools we already trust.
A Teams invite, Teams call, Microsoft login screen or Teams download page can still be fake.
If someone asks you to install software, approve access, share a code, download an update or sign in during a call, stop and check first.
What should businesses do?
You do not need to ban Teams.
You do not need to treat every meeting as suspicious.
You do need to tighten the basics around identity, devices, training, software installs and monitoring.
1. Train people using realistic examples
Generic phishing training is easy to ignore.
Realistic training works better because it feels familiar.
Use examples staff are likely to recognise:
A fake Teams invite.
A fake Teams landing page.
A fake Teams download.
A fake Microsoft login.
A fake support call.
A fake update prompt during a meeting.
Use these as short internal discussions:
What would make this feel believable?
What would make you pause?
Who would you ask before installing anything?
Where should software be downloaded from?
What should happen if someone clicks?
The aim is to give people a safe rehearsal before the real thing lands.
2. Make “check first” normal
Staff should not feel silly for asking.
They should know exactly what to do if something feels slightly off.
That could be:
Forward the email to IT.
Call the supplier on a known number.
Message a manager.
Use a dedicated reporting button.
Ask before installing software.
Stop a call if someone starts pressuring them.
Check the official download link before installing an app.
A good culture beats a blame culture every time.
3. Control who can install software
The Huntress and fake Teams download examples both matter because the attacker wanted the victim to install something.
That should be a red flag for every business.
Staff should not usually need local admin rights for day-to-day work.
If someone on a Teams call says, “You need to install this update,” that should trigger a process, not an immediate install.
Review:
Local admin rights.
Software install permissions.
Approved app stores and download locations.
Remote access tools.
Browser extensions.
Unmanaged devices.
Approved support channels.
Where possible, provide staff with a clear internal link for approved software downloads.
Do not leave them searching Google for business-critical tools.
4. Teach people not to trust search adverts blindly
This is especially important for fake Teams downloads.
Many people do not type web addresses directly. They search for the thing they need and click the first result.
That creates an opening for criminals.
Make this simple:
Do not download Teams, Zoom, AnyDesk, Chrome, Adobe Reader, VPN tools or remote support tools from random adverts.
Use official vendor sites, company portals or links provided by IT.
If in doubt, ask.
This is not about making staff paranoid.
It is about stopping a very avoidable mistake.
5. Watch behaviour, not just web addresses
The Symantec report shows why basic “good domain / bad domain” thinking is not enough.
If malicious traffic is hidden inside trusted services, security tools need to look at behaviour.
That means watching for:
New admin accounts.
Unusual logins.
Strange PowerShell activity.
Unexpected remote access tools.
Security tools being disabled.
Credential dumping.
Lateral movement.
Suspicious driver activity.
Unusual outbound patterns.
New software installs from unusual locations.
This is where Managed EDR, MDR or MXDR can make a real difference.
The question is not only, “Where is this device connecting?”
It is also, “Why is this device suddenly behaving like this?”
6. Review external Teams access
Microsoft Teams is useful because it lets people collaborate outside the organisation.
That can also create risk.
Review whether external users can contact staff directly in Teams.
Check:
Who can start chats with your users?
Can external users send files?
Are users warned clearly when someone is outside the organisation?
Do staff know how to verify an external contact?
Are high-risk departments treated differently?
Can suppliers be verified through known channels?
For some businesses, open external Teams access may be fine.
For others, especially finance, legal, care, education and senior leadership teams, it may need tighter control.
7. Patch exposed systems and review old services
Symantec said the initial access route was unclear, but its analysis suggested the attackers may have exploited an unknown SQL or MSSQL server vulnerability, or obtained access through an initial access broker.
That should prompt a simple review.
What do you have exposed to the internet?
Old servers.
Remote access portals.
SQL services.
VPNs.
Firewalls.
Remote desktop.
Forgotten systems.
Attackers only need one way in.
8. Test your backups
If ransomware lands, the question becomes very practical.
Can you recover?
Not in theory.
Actually recover.
Check:
Are backups separate from the main network?
Can attackers delete or encrypt them?
Are Microsoft 365 emails, files and Teams data backed up?
Are server and endpoint backups tested?
Who starts the recovery?
How long would it take?
What order would systems be restored in?
A backup plan should not be a mystery you solve during an incident.
A short message you can send to staff
You could send something like this:
We are seeing more attacks that abuse trusted tools like Microsoft Teams, Slack and Microsoft 365.
A Teams invite, call, update prompt or download page is not automatically safe just because it looks familiar.
Please pause and check before installing anything, approving access, sharing a code, downloading software or signing in during a call.
If something feels odd, ask.
You will never be criticised for checking.
That last sentence is important.
People report more when they are not scared of being blamed.
Final thought
This is where cyber security is heading.
Attackers are not always kicking the front door down.
Sometimes they walk in wearing a badge that looks familiar.
A Teams invite.
A Slack workspace.
A Microsoft login.
A supplier call.
A support request.
A fake Teams download.
Normal traffic to a trusted service.
That is why the answer has to be layered.
Train people.
Limit admin rights.
Use trusted software sources.
Patch exposed systems.
Monitor behaviour.
Back up properly.
Make reporting easy.
Update 07/07/2026: fake IT support calls on Teams are now pushing EtherRAT
Since writing this, BleepingComputer has reported another Microsoft Teams attack that follows the same pattern.
This time, the attacker did not just send a fake Teams invite or hide behind Microsoft traffic.
They used a Teams voice call.
According to BleepingComputer, the campaign was reported by Palo Alto Networks’ Unit 42 and involved attackers impersonating corporate IT support staff on Microsoft Teams. The aim was to trick the victim into installing malware called EtherRAT.
The attack started with a phishing email using an “Employee Survey” lure and a malicious PDF attachment. Shortly after the document was opened, the victim received a Teams voice call from an external account pretending to be a “System Administrator”. Unit 42 said the Teams window showed an “External unfamiliar” label, which means the caller came from outside the organisation and had no trusted relationship with the company.
During a busy working day, with someone claiming to be IT support, it is easy to see how a member of staff could be pressured into continuing.
The attacker then persuaded the victim to grant remote control through Teams screen sharing. After that, they guided the victim through installing legitimate remote access tools, including HopToDesk and AnyDesk. Once remote access was established, the attacker downloaded and ran a malicious MSI installer that eventually launched EtherRAT.
EtherRAT is a remote access trojan written in Node.js. In plain English, it can give an attacker control over a compromised machine. BleepingComputer reports that it can execute commands, manipulate files, steal data and maintain persistence. It also uses Ethereum smart contracts to find its command-and-control server, which can make it harder to disrupt.
In this case yhe victim was not simply asked to click a bad link. They were contacted by someone pretending to help. They were shown a familiar platform. They were guided through actions that can look like normal IT support.
That is why this type of attack is dangerous for small businesses.
A Teams call from “IT support” can feel more believable than a random phishing email.
A remote access tool can sound reasonable if someone says they need to fix your device.
A warning that says “external” can be missed if the caller sounds confident, urgent or helpful.
The lesson for staff is simple:
If someone contacts you on Teams and asks you to install software, approve remote control, open Command Prompt, download a tool, share a code or visit a support page, stop and check first.
Real IT support should not mind being verified.
For businesses, this is another reason to review:
External Teams access.
Who can contact staff through Teams.
Whether staff understand the “External” and “External unfamiliar” labels.
Whether users can install remote access tools.
Whether local admin rights are still needed.
Whether remote support tools are approved and controlled.
Whether Microsoft Teams audit logs are being reviewed.
Whether EDR or MDR is watching for unusual behaviour after a support-style call.
Microsoft does provide controls to manage external Teams communication, including allowing only specific external domains, blocking specific domains or users, and using external access policies for different users or groups.
For some organisations, open external Teams access may be fine.
For others, especially finance, senior leadership, HR, legal, education, care and anyone handling sensitive data, it may be worth tightening.
The important thing is not to panic.
Teams is still a useful business tool.
But staff need to understand that a Teams call is not automatically safe just because it appears inside Microsoft 365.
Attackers are learning to sound like support.
So businesses need to make “check first” part of normal work.
The next ransomware warning may not look like a warning.
It may look like a Teams meeting or the Teams download you found at the top of Google.
