# Threat Actors Weaponize Microsoft Teams Voice Calls to Deliver EtherRAT Malware


Attackers impersonate corporate IT support through external Teams calls, bypassing employee defenses with social engineering and legitimate remote-access tools


A sophisticated phishing campaign is exploiting Microsoft Teams voice calls to trick employees into installing the EtherRAT remote access trojan, giving attackers a foothold in corporate networks, according to research from Palo Alto Networks' Unit 42 published this week.


The campaign demonstrates how modern threats blend multiple attack vectors—spear phishing, voice impersonation, and legitimate remote-management tools—to evade traditional security controls. What makes this attack particularly insidious is its reliance on human trust and social engineering rather than zero-day vulnerabilities, making it effective against even well-defended organizations.


## The Attack Chain: From Email to Compromise


The attack sequence is methodical and designed to build trust at each stage:


1. Initial infection vector: Victims receive a phishing email containing a malicious PDF file disguised as an "Employee Survey"

2. Social engineering escalation: Within minutes of opening the PDF, the target receives an inbound Microsoft Teams voice call from an external account claiming to be corporate IT support

3. Remote access establishment: The attacker, displaying the "External unfamiliar" label indicating a different Microsoft 365 tenant, convinces the victim to share their screen via Teams' built-in functionality

4. Legitimate tool abuse: The attacker guides the victim through installation of commercially available remote-access software—specifically HopToDesk and AnyDesk

5. Malware deployment: Once remote access is secured, the attacker downloads and executes a malicious MSI installer file (v7.msi) from the domain camorreado[.]click

6. RAT installation: The MSI serves as a loader, downloading a legitimate Node.js runtime, decrypting embedded payloads, and launching EtherRAT


The sophistication lies in the use of legitimate tools. Since HopToDesk and AnyDesk are real, widely-used remote-access platforms, they bypass many organizations' application-control policies and don't trigger endpoint detection systems. The attacker essentially walks through the front door using the victim's own trust.


## EtherRAT: A Cross-Platform Remote Access Trojan


EtherRAT is a Node.js-based remote access trojan that grants attackers comprehensive control over compromised systems. Key capabilities include:


| Capability | Impact |

|---|---|

| Command execution | Run arbitrary system commands with user privileges |

| File manipulation | Download, upload, delete, and modify files |

| Data exfiltration | Steal documents, credentials, and sensitive business information |

| Persistence mechanisms | Maintain access across system reboots |

| Lateral movement | Use compromised machine as staging point for network reconnaissance |

| C2 communication | Ethereum smart contracts for command retrieval, complicating takedown efforts |


The last point is particularly noteworthy. By using Ethereum smart contracts to retrieve its command-and-control server addresses, EtherRAT makes traditional network-based defenses less effective. Security teams cannot simply block known C2 domains; attackers can publish new C2 addresses to the blockchain in real time, making the malware's infrastructure highly resilient.


EtherRAT is not new—Unit 42 previously documented its use in state-sponsored cyberattacks exploiting the React2Shell vulnerability. However, its adoption has broadened beyond nation-state actors. The discovery of an open directory on the attacker's distribution server containing versions one through nine of the malware installer suggests the campaign is actively being refined and expanded.


## A Growing Trend: Microsoft Teams as an Attack Platform


This campaign is part of a broader pattern of threat actors exploiting Microsoft Teams as a vector for corporate network compromise. The timing and evolution of these attacks reveal a strategic shift:


  • March 2026: Attackers targeted financial and healthcare organizations by flooding inboxes with spam before pivoting to Microsoft Teams impersonation, leading to Quick Assist sessions and deployment of the newly documented A0Backdoor malware
  • April 2026: Microsoft issued warnings about attackers impersonating helpdesk personnel via external Teams accounts, using remote access to conduct reconnaissance, lateral movement, and data theft
  • July 2026: The current campaign raises the bar, combining Teams voice calls, legitimate remote tools, and a sophisticated malware loader

    • Why Teams? The platform has become ubiquitous in corporate environments, making it an effective social engineering vector. Employees are conditioned to trust internal communications, and the "External unfamiliar" label—while visible—doesn't reliably deter users who expect legitimate communication from external vendors or partners. Additionally, Teams voice calls create a sense of urgency and authority that text-based phishing often lacks.


    ## Implications for Organizations


    Endpoint risk: Once EtherRAT gains access, attackers have achieved what security professionals call "initial access"—the hardest part of a breach. From there, reconnaissance, privilege escalation, and lateral movement to critical systems are routine.


    Supply chain exposure: Organizations with lax remote-access policies may become stepping stones for attacks on downstream partners. A compromised mid-market company could serve as the entry point for attacks on larger enterprises.


    Detection gaps: The use of legitimate remote-access tools and Node.js (a common runtime) means attackers blend in with normal business activity. Organizations relying solely on signature-based or behavioral detection may miss the intrusion entirely.


    ## Microsoft's Defensive Response


    Microsoft has deployed several protections in response to Teams-based threats:


  • External caller warnings: Teams now displays prominent notifications when calls or chats originate from external Microsoft 365 tenants, though user behavior shows warnings alone don't prevent social engineering
  • Meeting lobby policies: A new administrator policy automatically routes suspected third-party bots to a lobby, requiring manual approval before they can join meetings
  • Audit logging: Enhanced audit trails for external interactions, enabling organizations to detect and investigate suspicious activity

    • However, these controls remain reactive. The "External unfamiliar" label in the reported campaign did not stop the attack—it merely informed the victim of the reality that experienced attackers had already explained to them plausibly.


    ## Recommendations for Defense


    For security teams:

  • Implement Teams policies that restrict external voice calls to pre-approved domains or require explicit administrator approval
  • Deploy application-control policies that whitelist approved remote-access tools and block unauthorized alternatives
  • Monitor for anomalous remote-access tool usage through EDR (endpoint detection and response) solutions, particularly monitoring for unexpected outbound C2 communication patterns
  • Conduct regular phishing and vishing simulations to train employees to verify unexpected support requests through independent channels

    • For employees:

  • Never grant screen-sharing or remote access to callers you haven't independently verified
  • Verify support requests independently: If someone claims to be IT support, hang up and call your IT department directly using a known phone number
  • Be suspicious of urgency: Legitimate IT support typically doesn't call unexpectedly demanding immediate remote access

    • For organizations:

  • Review remote-access tool policies: Ensure only authorized tools are permitted and monitor for unauthorized installations
  • Segment networks: Limit the scope of damage if a single device is compromised through proper network segmentation
  • Enhance user training: Make social engineering awareness a core component of security culture, not an annual checkbox

    • ## HackWire Analysis


    This campaign illustrates a critical blind spot in modern cybersecurity: we've made significant technical investments in detecting malware and blocking known attack infrastructure, yet sophisticated threat actors continue to exploit the weakest link—human judgment. The attacker in this case didn't need zero-days, advanced evasion techniques, or expensive custom malware. They needed a phone call and convincing story.


    The pattern is striking. In March, attackers flooded inboxes to lower victims' defenses. In April, they exploited helpdesk impersonation. Now, in July, they're adding voice calls to their toolkit. Each iteration suggests the previous versions succeeded at scale, and each refinement removes friction from the social engineering process. Microsoft's new warnings about external callers are well-intentioned but insufficient—the very label that's meant to protect users becomes a detail that attackers now proactively explain away.


    What's overlooked in most Teams-abuse reporting is the role of legitimate remote-access tools. HopToDesk and AnyDesk themselves are not malicious. They're used daily by IT departments worldwide. The security problem isn't the tools—it's that once an attacker has a victim on the phone, social engineering is largely solved. The technical sophistication of the attack pipeline (the Node.js loader, Ethereum-based C2, multi-stage delivery) is almost secondary to the core mechanic: convince someone to run what you tell them to run.


    Organizations that think their endpoint detection and response solutions will catch this are in for a shock. EtherRAT running via Node.js, executed by a legitimate MSI installer, launched after a user intentionally granted remote access—this creates a detection vacuum. The malware isn't "unauthorized" in the sense that most EDR tools understand it. It was authorized by the victim themselves.


    The real lesson: security investments that ignore the human layer will continue to fail. Security awareness training that doesn't specifically address vishing (voice phishing) and the verification of unexpected support requests should be updated immediately. And organizations with remote-access policies that don't account for attacker social engineering are operating with policies that look good on paper but fail in practice.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)