Fake IT Support Calls on Microsoft Teams Push EtherRAT — Node.js RAT Using EtherHiding (Ethereum Smart Contract C2), Linked to React2Shell (CVE-2025-55182) Exploitation Chain
Fake IT Support Calls on Microsoft Teams Push EtherRAT (TL-2026-1141), also tracked as EtherRAT Teams Vishing Campaign, is a high-severity malware campaign, first published 2026-07-06. It is attributed to EtherHiding malware-as-a-service tooling (North Korea) with medium confidence, affects Microsoft Microsoft Teams (external collaboration / federation), references 1 CVE (CVE-2025-55182), maps to 36 MITRE ATT&CK techniques (T1003, T1020, T1021), and is covered by 9 detection rules and 41 indicators of compromise.
Key facts for TL-2026-1141
- Threat ID
- TL-2026-1141
- Also known as
- EtherRAT Teams Vishing Campaign, Fake IT Support Teams Malware Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-06
- Last reviewed
- 2026-07-06
- Attribution
- EtherHiding malware-as-a-service tooling
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- retail, financial services, health, software, business services
- Target regions
- North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 41
Malware and tooling in Fake IT Support Calls on Microsoft Teams Push EtherRAT
Malware and tooling: EtherRAT, Gentleman ransomware, TukTuk, 0x5953f27F044779a3AFCd2BF56a4B712583Dd2E4e, 0xdf0b529043ef7a2bb9111bad26de624a326bacf9, 0xe26c57b7fa8de030238b0a71b3d063397ac127d3, AnyDesk, GoTo Resolve, HopToDesk, Mimikatz, NetExec, Quick Assist
Threat actors impersonate IT/System Administrator staff via external Microsoft Teams accounts (e.g. helpdesk@Progressive936.onmicrosoft.com) and an 'Employee Survey' phishing lure to socially engineer victims into screen-sharing, then chain legitimate remote tools (HopToDesk, AnyDesk) into a malicious MSI installer (v7.msi, hosted at camorreado.click) that deploys a portable Node.js runtime and launches EtherRAT — a cross-platform RAT that resolves its C2 server from Ethereum smart contracts via the 'EtherHiding' technique. EtherRAT/EtherHiding tooling has TTP overlap with DPRK-linked 'Contagious Interview' activity (UNC5342) and has separately been chained by financially-motivated affiliates into TukTuk backdoors and Gentleman ransomware; a Linux variant of the same malware family has been deployed via exploitation of the React2Shell deserialization vulnerability (CVE-2025-55182, CVSS 10.0).
How Fake IT Support Calls on Microsoft Teams Push EtherRAT works
This threat documents an active social-engineering-to-malware campaign, first reported by Palo Alto Networks Unit 42 (GitHub report dated 2026-06-28, syndicated by BleepingComputer on 2026-07-06), in which attackers impersonate corporate IT/helpdesk staff to obtain hands-on-keyboard access to victim machines and deploy the EtherRAT remote access trojan. The intrusion begins with a phishing email carrying an 'Employee Survey' PDF lure, followed by a voice call or chat initiated from an external Microsoft Teams / Entra ID tenant account (helpdesk@Progressive936.onmicrosoft.com) impersonating a System Administrator. This mirrors a broader, well-documented 2026 trend of cross-tenant Teams helpdesk impersonation abused by multiple clusters (Microsoft's 'Help on the line' and cross-tenant helpdesk playbook advisories, Mandiant's UNC6692/SNOW malware campaign, and MuddyWater's false-flag ransomware Teams operation), all of which exploit Teams' default external-collaboration settings and use email bombing or urgency lures to justify unsolicited IT contact.
Once trust is established, the victim is walked through installing legitimate remote-access software (HopToDesk, then AnyDesk) via Teams screen-sharing, giving the attacker persistent remote control. The attacker then delivers a malicious MSI installer (observed as v1.msi through v9.msi in an open directory on camorreado.click) that acts as a loader: it silently drops a portable Node.js runtime, decrypts obfuscated JavaScript payloads, and launches EtherRAT.
EtherRAT is a cross-platform, Node.js-based backdoor whose defining feature is 'EtherHiding' — rather than hardcoding a C2 address that defenders can block or law enforcement can seize, the malware queries public Ethereum (and in related campaigns, BNB Smart Chain) RPC providers (e.g., 1rpc.io) to read the current C2 URL from an on-chain smart contract (observed contracts include 0xe26c57b7fa8de030238b0a71b3d063397ac127d3, 0xdf0b529043ef7a2bb9111bad26de624a326bacf9, and 0x5953f27F044779a3AFCd2BF56a4B712583Dd2E4e). Operators rotate infrastructure cheaply by issuing on-chain setString-style updates, and observed follow-on C2 destinations include TryCloudflare tunnels. Once connected, EtherRAT disguises beacon traffic as ordinary CDN requests (random hex paths, UUIDs, .ico/.png/.css extensions), persists via a 12-character randomized-hex Registry Run key executed headlessly through conhost.exe, self-modifies by having the C2 return freshly obfuscated source on each check-in, and provides remote command execution, file manipulation, OS/cloud fingerprinting, and theft of cryptocurrency wallets and cloud credentials. It also contains CIS-region language-based self-destruction logic consistent with DPRK-affiliated tooling.
Sysdig and multiple independent researchers (eSentire TRU, GBHackers, Infosecurity Magazine, cybersecuritynews) assess that EtherRAT and EtherHiding show significant TTP overlap with the DPRK-linked 'Contagious Interview' cluster tracked by Google as UNC5342 (aka CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang, Tenacious Pungsan, Void Dokkaebi), which has used EtherHiding since February 2025 to serve JADESNOW/INVISIBLEFERRET payloads from BNB Smart Chain and Ethereum contracts in fake job-interview lures. However, EtherRAT is also observed operating as a malware-as-a-service capability used by other, apparently financially-motivated actors: The DFIR Report documented an April 2026 intrusion in which a malicious MSI masquerading as Sysinternals 'RAMMap' deployed EtherRAT, which was chained into the 'TukTuk' backdoor (DLL-sideloaded via trojanized Greenshot/SyncTrayzor/DocFX/Cake binaries, using ClickHouse Cloud, Supabase, Ably, Dropbox, GitHub Issues, and an Arweave-blockchain-hosted config as C2/fallback channels) and ultimately domain-wide 'Gentleman' ransomware deployment via a malicious Group Policy Object staged through SYSVOL/NETLOGON scheduled tasks, following extensive AD/domain-trust reconnaissance, SoftPerfect Network Scanner discovery, NetExec- and Mimikatz-enabled lateral movement/credential theft, and Rclone-based mass exfiltration to Wasabi cloud storage.
Separately, Unit 42/BleepingComputer note that EtherRAT has previously been used in state-sponsored attacks exploiting the 'React2Shell' vulnerability (no CVE cited in the source article). Corroborating vendor research (Sysdig, Google Cloud, Microsoft, Cloudflare, AWS, Trend Micro) identifies this vulnerability as CVE-2025-55182, a maximum-severity (CVSS 10.0) unauthenticated remote code execution flaw in React Server Components' Flight deserialization logic (CWE-502, affecting react-server-dom-webpack 19.0.0, 19.1.0, 19.1.1, and 19.2.0), added to the CISA KEV catalog on 2025-12-05. Sysdig specifically reports a Linux-targeting EtherRAT variant deployed via React2Shell exploitation beginning December 2025, alongside separate China-nexus exploitation of the same CVE by Earth Lamia/Jackpot Panda deploying MINOCAT, SNOWLIGHT, HISONIC, COMPOOD, and XMRig — underscoring that React2Shell is a shared initial-access vector exploited by multiple unrelated threat clusters, of which the EtherRAT operators are one.
Malwarebytes independently mapped a broader malicious infrastructure cluster (June 2026) distributing EtherRAT MSI/PowerShell payloads, phishing pages, and remote-desktop software from open directories, consistent with the camorreado.click distribution model described here. Given full remote-access capability, credential and cryptocurrency theft, demonstrated ransomware follow-on, and confirmed active in-the-wild use across at least three independent DFIR/vendor reporting chains between December 2025 and July 2026, this threat is assessed HIGH severity/CRITICAL impact despite the absence of a single scored CVE for the malware itself.
MITRE ATT&CK techniques used in TL-2026-1141
Credential Access
T1003 OS Credential Dumping; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Exfiltration
T1020 Automated Exfiltration; T1567 Exfiltration Over Web Service
Lateral Movement
T1021 Remote Services; T1570 Lateral Tool Transfer
Defense Evasion
T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information
Discovery
T1046 Network Service Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1135 Network Share Discovery; T1482 Domain Trust Discovery; T1518 Software Discovery
Execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1572 Protocol Tunneling
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools
Collection
Initial Access
T1199 Trusted Relationship; T1566 Phishing
Impact
T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery
Persistence
T1547 Boot or Logon Autostart Execution
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
stealth
Resource Development
T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1608 Stage Capabilities
Reconnaissance
Affected products and versions in Fake IT Support Calls on Microsoft Teams Push EtherRAT
- Microsoft — Microsoft Teams (external collaboration / federation)
Vulnerable versions: Default configuration with external access/federation enabled
Fixed in: N/A — social-engineering technique; mitigated via Teams external-access restriction policies - Meta / React (via Vercel/Next.js ecosystem) — React Server Components (react-server-dom-webpack)
Vulnerable versions: 19.0.0; 19.1.0; 19.1.1; 19.2.0
Fixed in: Patched release per GHSA-fv66-9v8q-g76r - OpenJS Foundation — Node.js runtime
Vulnerable versions: N/A — legitimate portable runtime abused as an execution vehicle by the EtherRAT loader, not vulnerable itself
Fixed in: N/A - Microsoft — Windows (Quick Assist / Remote Assistance)
Vulnerable versions: All supported Windows versions with Quick Assist installed and enabled for standard users
Fixed in: N/A — abuse of legitimate feature; mitigate via Group Policy restriction
Remediation for Fake IT Support Calls on Microsoft Teams Push EtherRAT
Patches
- Apply the Meta/Vercel/Next.js patch for CVE-2025-55182 (GHSA-fv66-9v8q-g76r) — upgrade react-server-dom-webpack beyond 19.2.0
Immediate actions
- Restrict Microsoft Teams external access/federation to an explicit allow-list of trusted domains; block or heavily scrutinize unsolicited external one-on-one chats and voice calls
- Block outbound access to camorreado.click, borjumaniya.store, and other known EtherRAT/TukTuk C2 endpoints at the perimeter/proxy/DNS layer
- Restrict installation of Quick Assist, HopToDesk, and AnyDesk to IT-managed devices via application allow-listing; alert on new installs from standard-user contexts
- Hunt for msiexec.exe spawning node.exe or unexpected child processes from user-writable directories (Downloads, Temp, AppData)
- Upgrade React Server Components (react-server-dom-webpack) beyond versions 19.0.0/19.1.0/19.1.1/19.2.0 to remediate CVE-2025-55182 (React2Shell)
Workarounds
- Disable mshta.exe and pcalua.exe via AppLocker/WDAC to break ClickFix-style HTA execution chains associated with related EtherRAT initial-access variants
- Restrict WinRM to authorized management workstations only and disable Quick Assist for standard users via Group Policy
Longer-term hardening
- Deploy EDR/NGAV behavioral detection for randomized-hex Registry Run-key persistence, DLL side-loading, and LSASS/NTDS credential dumping
- Establish verbal/out-of-band verification codes between real IT helpdesk staff and employees before any remote-access session is granted
- Monitor and alert on outbound connections from endpoint/workstation subnets to public Ethereum/BNB RPC providers (e.g., 1rpc.io) and blockchain explorers
- Enforce Conditional Access requiring MFA and compliant devices for privileged/administrative roles to blunt post-compromise lateral movement
- Implement egress monitoring for Rclone-style bulk/parallel transfers to cloud storage providers (Wasabi, Supabase, ClickHouse Cloud, Arweave gateways)
CVEs associated with Fake IT Support Calls on Microsoft Teams Push EtherRAT
Weaknesses (CWE) in Fake IT Support Calls on Microsoft Teams Push EtherRAT
CWE-502
Timeline of Fake IT Support Calls on Microsoft Teams Push EtherRAT
- Sysdig identifies a Linux-targeting EtherRAT variant deployed via React2Shell (CVE-2025-55182) exploitation, assessed with DPRK TTP overlap.
- CVE-2025-55182 ('React2Shell'), a maximum-severity unauthenticated RCE in React Server Components, publicly disclosed with a CVSS score of 10.0.
- CISA adds CVE-2025-55182 to the Known Exploited Vulnerabilities catalog based on evidence of active exploitation, with a remediation due date of 2025-12-26.
- eSentire Threat Response Unit detects EtherRAT/EtherHiding activity in a Retail-sector customer environment; Windows variant campaign emerges using Teams IT-support scams and Quick Assist for initial access, with activity dating back to December 2025.
- Microsoft publishes 'Help on the line' blog documenting Teams support-call social engineering leading to compromise.
- A malicious MSI masquerading as Sysinternals RAMMap begins deploying EtherRAT in intrusions later documented by The DFIR Report, chaining into TukTuk and ransomware.
- eSentire's EtherRAT/EtherHiding analysis (SYS_INFO module, CDN-like beaconing, target selection across Retail, Finance, Software, and Business Services) is syndicated by cybersecuritynews, Infosecurity Magazine, GBHackers, and securityonline.info.
- TheHackerNews reports EtherRAT distribution via GitHub facades spoofing administrative tools.
- Microsoft publishes a cross-tenant helpdesk impersonation intrusion playbook describing Teams-initiated Quick Assist compromise, WinRM lateral movement, and Rclone exfiltration — the same broad TTP class abused in this campaign.
- The DFIR Report publishes a flash alert detailing a full intrusion chain from EtherRAT through TukTuk C2 (ClickHouse/Supabase/Arweave) to domain-wide 'Gentleman' ransomware deployment via malicious Group Policy.
- Malwarebytes publishes analysis of a broader malicious infrastructure cluster distributing EtherRAT MSI/PowerShell payloads and phishing pages from open directories.
- Palo Alto Networks Unit 42 publishes the primary report on this specific campaign: fake IT-support Teams calls (helpdesk@Progressive936.onmicrosoft.com) leading to HopToDesk/AnyDesk installation and EtherRAT delivery via camorreado.click.
- BleepingComputer publishes coverage of the Unit 42 findings; threat TL-2026-1141 opened for tracking.
Sources cited for Fake IT Support Calls on Microsoft Teams Push EtherRAT
- Fake IT support calls on Microsoft Teams push EtherRAT malware
- EtherRAT & SYS_INFO Module: C2 on Ethereum (EtherHiding), Target Selection, CDN-Like Beacons
- EtherRAT Techniques Bypass Security Via Ethereum Smart Contracts
- Hackers Use EtherRAT and EtherHiding to Hide Malware Infrastructure on Ethereum
- Ethereum-Based EtherRAT, EtherHiding Power Stealthy Malware Campaigns
- EtherRAT Malware Hijacks Ethereum Blockchain for Covert C2 After React2Shell Exploit
- EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks
- EtherRAT Distribution Spoofing Administrative Tools via GitHub Facades
- Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware
- DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains
- North Korean hackers use EtherHiding to hide malware on the blockchain
- Help on the line: How a Microsoft Teams support call led to compromise
- Cross-tenant helpdesk impersonation to data exfiltration: A human-operated intrusion playbook
- UNC6692 Impersonates IT Help Desk via Microsoft Teams to Deploy SNOW Malware
- Detecting Microsoft Teams Phishing: Hunting the Fake IT Helpdesk Threat
Threats related to Fake IT Support Calls on Microsoft Teams Push EtherRAT
- EtherRAT: DPRK-Linked Vishing Campaign Abuses Microsoft Teams and Ethereum Smart Contracts to Deliver Blockchain-Resilient Node.js RAT
- ClickFix Campaign Deploying Potemkin Loader, RMMProject RAT, and EtherRAT - May 2026 Enterprise Compromise
- SharkLoader Malware Campaign Uses Fake Cisco AnyConnect and Google Update Installers to Deploy Cobalt Strike
- TeamPCP LiteLLM Supply Chain Attack — Trojaned PyPI Packages (v1.82.7/1.82.8) with Multi-Stage C2 Payload
- ChocoPoC: Python RAT Distributed via Trojanized PoC Exploits Targeting Security Researchers
- The Gentlemen Ransomware: Worm-Like Self-Propagation and Network-Wide Encryption via Storm-2697's RaaS Affiliate Program
Detection coverage for TL-2026-1141
As of 2026-07-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1141 across Splunk SPL, Microsoft KQL and Sigma, covering 41 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.