Critical Flaw in Deno-Based RAT Impersonates Microsoft Teams, Mailbombs Employees

Key Takeaways

• A new Deno-based Remote Access Trojan (RAT) is being deployed through a multi-stage social engineering attack.
• The attack combines mailbombing with Microsoft Teams impersonation to disorient and trick employees into installing malware.
• The malware leverages Deno, a JavaScript/TypeScript runtime, and is designed with modularity and obfuscation to evade detection by endpoint security tools.
• The threat highlights a growing trend of attackers using legitimate platforms and unconventional scripting environments to bypass traditional defenses.

Cybersecurity researchers have uncovered a sophisticated new Remote Access Trojan (RAT), dubbed “Deno RAT,” which targets employees through a multi-pronged attack strategy. This novel approach, detailed in a report, combines overwhelming mailbombing tactics with convincing impersonations of Microsoft Teams IT support to manipulate victims into installing the malware.

The attackers exploit the inherent trust in internal communications and the urgency of a manufactured crisis. By first flooding a target’s inbox, they create a chaotic environment, then present themselves as the solution via a fake Microsoft Teams call, turning a perceived rescue into a successful compromise.

Anatomy of the Deno RAT Attack

Initial Compromise: Mailbombing and Teams Impersonation

The attack chain commences with a mailbombing campaign, where targeted employees receive a deluge of hundreds of emails within a brief timeframe. This tactic aims to disorient the victim and induce panic, making them more susceptible to subsequent social engineering efforts.

Once the employee’s inbox is overwhelmed, the attacker initiates a call via Microsoft Teams. The caller impersonates an internal IT support agent, using an external account carefully crafted to resemble a legitimate organizational identity. Information such as employee names and company context, likely gleaned from public sources like LinkedIn, is used to bolster credibility. During one observed incident, two employees did not answer, but a single interaction with a third was sufficient for the attack to proceed.

The victim is then directed to a deceptive self-service portal, meticulously designed to mimic a legitimate IT support workflow. This fraudulent page instructs the user to download a file and extract its contents into their AppData directory—a location often overlooked by users and less likely to trigger immediate security alerts.

Technical Framework: Deno and Evasion Tactics

Analysts at InfoGuard Labs, who investigated this intrusion, highlighted the malware’s unusual technical foundation. Instead of conventional compiled executables, the attackers deployed a modular RAT built on Deno, a JavaScript and TypeScript runtime environment. Deno is notable for its “security-first” design, requiring explicit permissions for sensitive operations like file access and network activity.

InfoGuard Labs noted that the implant was divided into four distinct JavaScript files: app.js, back.js, helper.js, and webui.js. Each file was responsible for a specific function, such as orchestrating other modules, managing the command-and-control (C2) connection, executing local commands, or facilitating internal network pivoting. This modular design helps maintain a low overall footprint and allows each component to request only the necessary permissions, thereby appearing less suspicious to security tools.

The C2 server for the Deno RAT was hosted behind an Amazon CloudFront domain. This strategic choice helps mask outbound C2 traffic, making it appear as legitimate communication with a content delivery network, further aiding evasion.

A critical observation was that an active endpoint detection tool present on the compromised machine failed to detect the malware during its initial execution. Alerts only surfaced later, when the attacker began post-exploitation activities such as LDAP queries and certificate-related reconnaissance. This delay suggests that the malware was specifically engineered to evade initial detection, relying on the unconventional Deno runtime and modular structure.

Obfuscation and Detection Challenges

All four JavaScript files comprising the Deno RAT were heavily obfuscated using a technique known as string array shifting. This method replaces readable strings with scrambled arrays that only reconstruct at runtime, effectively thwarting static analysis tools that typically scan for known URLs or command-line arguments. This leaves security analysts with garbled output, making it difficult to understand the malware’s true intent without dynamic analysis.

The reliance on behavioral indicators rather than content-based signatures underscores a significant challenge for traditional security defenses. Modern attackers are increasingly combining social engineering, legitimate platforms, and less scrutinized scripting runtimes to craft attack chains that bypass security solutions designed for older threat models.

What You Should Do

• Enhance Employee Training: Conduct regular security awareness training emphasizing the risks of mailbombing, social engineering via communication platforms like Teams, and the importance of verifying IT support requests through official channels.
• Monitor Deno Processes: Implement monitoring for Deno processes launched from user-writable directories (e.g., AppData). This is an anomalous behavior that should trigger alerts.
• Correlate Alerts: Correlate alerts from email security gateways (for mailbombing activity) with Microsoft Teams audit logs (for external calls or suspicious activity) to identify potential multi-stage attacks early.
• Enable Full Microsoft 365 Audit Logging: Ensure comprehensive audit logging is enabled within Microsoft 365, particularly for Teams and email activities, to provide granular visibility into potential impersonation attempts and initial access vectors.
• Review External Communication Policies: Reiterate policies regarding external communication, especially for “IT support” requests. Employees should be instructed to independently verify such requests through established internal processes.
• Indicators of Compromise (IoCs):
  • SHA-256: d317371cf2b4cd524849551ffd3b97d91edbc17f6b39c8693217383ba6a0370d (app.js)
  • SHA-256: 9469268c421b7821f897deb2d4d2316b21ff5da35bef417aa4e284010ef78302 (back.js)
  • SHA-256: 3d8afae76c5982458849d21221e089ee161266a4248b12ea3048d1e79b76707e (helper.js)
  • SHA-256: 2ed6fdfa5f9120306167ba5d8d48a62dbe5fd0d05e87c33c9784f08698f8a66b (webui.js)
  • SHA-256: 3b48a334dcf0a08bed2a9766fd553474ae3014db600b65573dfee0f183e9d1d9 (patch09913.bd)
  • Domain: 2cff16eusb8mg.cloudfront[.]net (C2 server domain hosted via CloudFront CDN)

  Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.