New Vishing Attack Leverages Microsoft Teams Calls and QuickAssist to Deploy .NET Malware

Du'aine Davis

Observed in the wild

• A new vishing campaign, identified on 9 December by SpiderLabs, targets organisations through Microsoft Teams calls and QuickAssist. Attackers impersonate senior IT staff to create urgency, tricking victims into granting remote access. The infection chain culminates in a stealthy .NET-based malware deployment, impacting endpoints without leaving traditional forensic artefacts.
• Threat actors use spoofed Teams accounts for initial contact, persuading targets to run QuickAssist to bypass security controls. After gaining access, victims are redirected to a malicious domain (ciscocyber[.]com), where an updater.exe wrapper loads encrypted payloads via AES-CBC and XOR. The malware executes in memory using .NET reflection, ensuring persistence and evasion.
• Organisations should monitor for unusual QuickAssist usage and external Teams calls, especially from accounts claiming IT authority. Microsoft Defender users should enable advanced behavioural detection for fileless attacks, scrutinise memory-based execution patterns, and block suspicious domains like jysync[.]info. Reinforce user training on social engineering and validate remote support requests through official channels.

SpiderLabs on X: "#Vishing Campaign Alert: Microsoft Teams Call -> QuickAssist Abuse -> Multi…