Fake IT Support Calls on Microsoft Teams Deliver EtherRAT Malware

A new social engineering campaign is using Microsoft Teams calls to impersonate IT support and trick employees into installing malware.

According to Unit 42, the attack starts with a fake “Employee Survey” email and PDF. Shortly after, the victim receives a Microsoft Teams call from someone posing as a “System Administrator.” The attacker then abuses Teams remote control, guides the victim into installing remote access tools like HopToDesk or AnyDesk, and delivers a malicious MSI file that launches EtherRAT.

EtherRAT is a remote access trojan that uses the Ethereum blockchain to help locate its command-and-control server, making it harder to disrupt.

Why This Matters

This attack works because it feels familiar. Employees trust Microsoft Teams, recognize IT support language, and may not question a call that appears to come from a “System Administrator.”

The warning sign is the External unfamiliar label in Teams. That means the person is outside the organization and does not have a trusted relationship with the company.

What Businesses Should Do

Train staff to treat unexpected Teams calls like phishing attempts, especially when the caller asks for remote control, software installs, or command prompt access.

Businesses should also review Microsoft Teams external access settings, restrict unmanaged external chats where possible, monitor remote access tool installs, and make sure users know how to verify IT support requests before acting.

Britec Takeaway

Attackers are no longer relying on email alone. They are moving into the tools employees use every day.

A trusted IT process matters. If someone calls through Teams claiming to be support, employees should know exactly how to verify that request before giving access to their machine.

Britec helps businesses strengthen user awareness, Microsoft 365 security, endpoint protection, and support workflows so attacks like this are easier to spot and stop.