Fake IT Support Calls on Microsoft Teams Deliver EtherRAT Remote‑Access Trojan
What Happened – Threat actors are using Microsoft Teams voice calls, masquerading as corporate IT support, to convince users to install the Node.js‑based EtherRAT RAT. The campaign starts with a phishing email, follows with a Teams call from an external tenant, and leverages legitimate remote‑control tools (e.g., AnyDesk) to drop a malicious MSI that loads the RAT.
Why It Matters for Compliance & Audit Readiness
- Demonstrates a gap in SOC 2 Access Controls (CC6.1) – attackers obtain privileged remote sessions without proper verification.
- Highlights the need for documented Security Awareness Training and incident‑response playbooks that cover non‑email vectors such as Teams calls.
- Provides a concrete example of why continuous monitoring of privileged‑access logs is essential audit evidence for SOC 2 (CC7.1, CC8.1).
Who Is Affected – Financial services, healthcare, and other enterprise sectors that rely on Microsoft 365 for collaboration.
Recommended Actions
- Map the incident to SOC 2 access‑control criteria and capture Teams call logs as audit evidence.
- Enforce MFA and conditional‑access policies that block external tenant calls unless explicitly approved.
- Update security‑awareness curricula to include “voice‑call phishing” (vishing) scenarios and conduct regular simulated Teams‑call drills.
Source: BleepingComputer
Technical Notes – The attack chain combines a phishing email with a malicious PDF, a Teams voice call from an external Microsoft 365 tenant, remote‑desktop tools (HopToDesk, AnyDesk), and a malicious MSI that installs a Node.js runtime to launch EtherRAT. EtherRAT uses Ethereum smart contracts for C2, complicating takedown. Source: Unit 42 report (GitHub)