Fake Microsoft Teams downloads deploy ValleyRAT malware

Key Takeaways

• A new phishing campaign is leveraging deceptive Microsoft Teams download sites to distribute ValleyRAT malware.
• The attack chain involves sophisticated social engineering, DLL sideloading via a legitimate Tencent executable, and stealthy persistence mechanisms.
• K7 Security Labs researchers attribute the campaign to the Chinese APT group SilverFox, identifying Chinese language artifacts in the attack infrastructure.
• The malware establishes a covert presence, simultaneously installing a genuine Microsoft Teams application to avoid suspicion while exfiltrating sensitive user data.

Cybersecurity researchers have uncovered an active campaign exploiting fake Microsoft Teams download pages to infect users with ValleyRAT malware. This sophisticated operation, first observed in mid-April 2026, tricks unsuspecting individuals into compromising their systems while believing they are installing legitimate collaboration software.

Deceptive Tactics and Malware Delivery

Threat actors have crafted convincing replica websites designed to closely mimic the official Microsoft Teams download portal. These fraudulent sites, such as teams-securecall[.]com and teamszs[.]com, were actively promoted on the X platform (formerly Twitter), ensuring broad initial exposure for the campaign. When users visit these lookalike pages, they are presented with what appears to be a legitimate download button. Clicking this button initiates the download of a ZIP archive containing a weaponized installer.

According to analysis by K7 Security Labs, who first identified and dissected this campaign, the payload employs a DLL sideloading technique. This method leverages a legitimate Tencent executable, GameBox.exe, to load a malicious DLL. The researchers noted the presence of Chinese language artifacts within the fake websites and associated log data, strongly indicating the campaign’s origin in China. Furthermore, K7 Security Labs has linked this activity to the advanced persistent threat (APT) group known as SilverFox.

The campaign’s effectiveness lies in its ability to mask its malicious intent. Once the installer is executed, it surreptitiously deploys malicious components in the background. Simultaneously, it installs a genuine copy of Microsoft Teams on the victim’s device and even creates a desktop shortcut, ensuring the user remains unaware of the compromise. This dual-action approach allows the attackers to establish a fully functional remote access trojan (RAT) on the system without raising immediate alarms.

The ValleyRAT Infection Chain

The infection initiates when a user downloads and extracts the malicious ZIP file from one of the fraudulent domains. This action triggers an NSIS-based installer, which silently drops a loader, a malicious DLL named utility.dll, and various supporting files across the victim’s system. To maintain stealth, the malware executes PowerShell commands to modify Windows Defender settings, adding exclusions for its operational folder and the malicious DLL. It further conceals its files by altering their system-level attributes, making them invisible during routine system checks. A service named _CCGDAT is then established, ensuring the malware automatically restarts with every system boot, guaranteeing persistence.

The primary payload, user.dat, is stored in an AES-encrypted format and is exclusively decrypted in memory at runtime, preventing it from being detected on disk. ValleyRAT is then injected directly into the current running process using shellcode injection. To evade detection by security tools, the malware employs API hashing, dynamically resolving Windows functions rather than using static calls.

ValleyRAT’s Spying Capabilities and Evasion

Once active, ValleyRAT begins its surveillance activities. It continuously monitors the system clipboard using Windows API calls, specifically targeting sensitive information such as passwords, cryptocurrency wallet addresses, and other private data. The malware also incorporates keystroke logging capabilities, storing collected data locally before exfiltrating it to the attacker’s command and control (C2) server.

A crucial aspect of this campaign’s resilience is its dynamic payload delivery. The third-stage payload is fetched in an XOR-encrypted format directly from the C2 server and decrypted in memory. This dynamic loading mechanism allows the threat actors to change the payload at will, enabling them to adapt their tactics or deploy different tools without altering the initial infection vector. This design also ensures the attack remains effective even if specific components are identified and blocked by security solutions.

What You Should Do

• Download Software from Official Sources: Always obtain software directly from the official vendor’s website. Avoid downloading applications from third-party sites, untrusted links shared on social media, or email attachments.
• Verify Digital Signatures: Before running any installer, check its digital signature to confirm its authenticity and ensure it hasn’t been tampered with.
• Enable Application Allowlisting: Implement application allowlisting policies to prevent unauthorized or untrusted executables from running on your systems.
• Monitor for Suspicious Activity: Keep a close eye on your systems for unusual PowerShell activity, unexpected service creations (like _CCGDAT), or changes to security software settings (e.g., Windows Defender exclusions).
• Keep Security Software Updated: Ensure all endpoint detection and response (EDR) solutions, antivirus software, and operating systems are regularly updated to detect the latest behavioral threats and malware signatures.
• Educate Users: Conduct regular security awareness training for employees on phishing, social engineering tactics, and the importance of verifying download sources.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.