Security researchers at Avanan, a Check Point company, have recently identified that threat actors are spreading malware through Microsoft Teams conversations. Avanan, in their report linked below, detailed that the thousands of attacks utilizing this vector began in January 2022 and that actors are compromising Microsoft teams accounts in order to drop malicious executable files, specifically a file called “User Centric” in the sample provided. The actor can compromise the accounts in various ways, such as exfiltrating credentials for email, or Microsoft 365 through phishing campaigns, or the compromise of a targeted company’s partner organization. The “User Centric” trojan then writes data to the Windows registry, installs dynamic-linked libraries (DLLs), creates shortcut links to self-administer, sustains presence, and fully compromises the end-user’s machine. This technique is notable to researchers due to the “inherent trust of the platform” (Microsoft Teams) that users have. The report explained, “Most employees have been trained to second-guess identities in email, but few know how to make sure that the name and photo they see in a Teams conversation are real.” The researchers emphasized that this wave of attacks utilizing Microsoft Teams conversations demonstrate that “hackers are beginning to understand and better utilizing Teams as a potential attack vector”.