A novel attack technique was discovered by penetration tester Bobby Rauch that allows data exfiltration and command and control using GIFs sent through Microsoft Teams. The technique, which has been dubbed “GIFShell,” uses multiple Microsoft Teams flaws to achieve this feat. These vulnerabilities were discovered and reported to Microsoft in May and June 2022 but did not “meet [Microsoft’s] ‘bar for servicing'” and as such did not receive a fix. The attack starts when a victim executes a malicious stager written in PowerShell. The malware creates a new Teams tenant to allow Teams users from outside of the victim’s organization to create chats with the victim, a setting that is disabled in most organizations. The attacker then sends a Teams Card with a GIF embedded. Teams Cards are a feature that allows Teams messages to contain complex user interfaces, such as a survey box. Teams Cards also create a webhook that allows the user to send data back to Teams, answering the survey’s question, for example. Microsoft Teams will automatically render GIFs embedded in the Teams Card, which requires Teams to download the GIF from an external server. With GIFShell, the malicious GIFs are hosted on the threat actor’s server and include base64 encoded commands that the malware then executes. The GIFShell malware constantly scans the user’s Teams chat logs for the message. The output of the executed command is then encoded and sent back to the attacker by sending an HTTP request with the encoded data included as the name of a file with a .gif extension. This entire process allows for a two-way data transfer between the threat actor and the victim. There is a clear advantage to using this technique for command and control compared to simpler communication methods; GIFShell allows the threat actor to utilize Microsoft Teams and their servers to transmit all data. Teams is a known-good application in almost every organization and is considered trusted by most endpoint and network detection software. Mitigations to prevent this communication channel include turning off the default external access settings in the Teams Admin Center, monitoring for unusual access to Teams log files, and attempting to detect anomalous requests to Microsoft Teams URLs. The researcher has released a full tutorial on how to replicate this attack method, though no malware has been seen using this technique in the wild. Microsoft has stated the flaws used in the GIFShell attack may be patched in future versions. CTIX analysts will continue to monitor this technique and the associated flaws and will update on any future developments.