Vanilla Tempest late-September Microsoft Teams malvertising campaign
Campaign
Summary
Hide ▲
Show ▼
The late September 2025 Vanilla Tempest campaign used SEO poisoning and malvertising to push fake Microsoft Teams installers, including MSTeamsSetup.exe, to Windows users. The fake installers delivered the Oyster backdoor, which Microsoft said was later used in attacks that could lead to Rhysida ransomware. Microsoft Threat Intelligence revoked over 200 certificates fraudulently signed for the operation and said the group also used Trusted Signing, SSL.com, DigiCert, and GlobalSign to sign malicious installers and post-compromise tools. Microsoft said fully enabled Microsoft Defender Antivirus blocks the threat.
Related Happenings
Microsoft hit by cyberattack
Incident
H score68
First: 09.06.2026 18:42
Last: 09.06.2026 18:42
Sources 1
About this happening:
A **Microsoft** GitHub repository removal incident in **June 2026** disrupted **continuous integration pipelines** and briefly broke **Azure/functions-action** workflows used by d...
Microsoft hit by cyberattack
IncidentAbout this happening: A **Microsoft** GitHub repository removal incident in **June 2026** disrupted **continuous integration pipelines** and briefly broke **Azure/functions-action** workflows used by d...
Microsoft Defender zero-days exploited in attacks (multiple vulnerabilities)
Vulnerability
H score39
First: 21.05.2026 10:49
Last: 21.05.2026 10:49
Sources 1
About this happening:
Microsoft began rolling out fixes for **CVE-2026-41091** and **CVE-2026-45498**, two **actively exploited zero-days** in **Microsoft Defender** components that affect unpatched Wi...
Microsoft Defender zero-days exploited in attacks (multiple vulnerabilities)
VulnerabilityAbout this happening: Microsoft began rolling out fixes for **CVE-2026-41091** and **CVE-2026-45498**, two **actively exploited zero-days** in **Microsoft Defender** components that affect unpatched Wi...
Fox Tempest's malware-signing service scales trusted-signed malware for ransomware gangs
Threat Actor Meta
H score26
First: 20.05.2026 00:47
Last: 20.05.2026 00:47
Sources 1
About this happening:
Microsoft disrupted **Fox Tempest**'s **malware-signing service** in **May 2026**, cutting off a criminal platform that helped ransomware gangs and other cybercriminals obtain tru...
Fox Tempest's malware-signing service scales trusted-signed malware for ransomware gangs
Threat Actor MetaAbout this happening: Microsoft disrupted **Fox Tempest**'s **malware-signing service** in **May 2026**, cutting off a criminal platform that helped ransomware gangs and other cybercriminals obtain tru...
Microsoft civil action against Fox Tempest infrastructure takedown
Regulatory/Legal Action
H score24
First: 19.05.2026 18:00
Last: 19.05.2026 18:00
Sources 1
About this happening:
Microsoft filed a **civil action** against **Fox Tempest** in the **US District Court for the Southern District of New York**, securing a **court order** that enabled a broad disr...
Microsoft civil action against Fox Tempest infrastructure takedown
Regulatory/Legal ActionAbout this happening: Microsoft filed a **civil action** against **Fox Tempest** in the **US District Court for the Southern District of New York**, securing a **court order** that enabled a broad disr...
KongTuke Microsoft Teams initial access campaign
Campaign
H score42
First: 14.05.2026 15:12
Last: 14.05.2026 15:12
Sources 1
About this happening:
The **KongTuke** campaign now uses **Microsoft Teams** social engineering to gain persistent access to **corporate networks**, shortening initial compromise to **under five minute...
KongTuke Microsoft Teams initial access campaign
CampaignAbout this happening: The **KongTuke** campaign now uses **Microsoft Teams** social engineering to gain persistent access to **corporate networks**, shortening initial compromise to **under five minute...
Timeline
-
20.10.2025 13:00 1 articles · 8mo ago
Microsoft revokes 200+ fake Teams certificates used by Vanilla Tempest
Mitigation Patch UpdateMicrosoft Threat Intelligence revoked over 200 certificates fraudulently signed by Vanilla Tempest and used in fake MS Teams setup files to deliver the Oyster backdoor and Rhysida ransomware. Microsoft also said the group used Trusted Signing, SSL[.]com, DigiCert, and GlobalSign to sign fake installers and post-compromise tools, and that fully enabled Microsoft Defender Antivirus blocks this threat.
Show sources
- Microsoft Revokes 200+ Fake Certificates Used in Teams Malware Attack — www.infosecurity-magazine.com — 20.10.2025 13:00
-
16.10.2025 19:58 2 articles · 8mo ago
Vanilla Tempest late-September Microsoft Teams malvertising campaign
Initial DisclosureThe operation began in **late September 2025** with **search ad** and **SEO poisoning** lures that funneled victims to fake **Microsoft Teams** installers. The first phase centered on establishing an initial foothold on **Windows devices** through the **MSTeamsSetup.exe** payload and the **Oyster** backdoor.
Show sources
- Microsoft disrupts ransomware attacks targeting Teams users — www.bleepingcomputer.com — 16.10.2025 19:58
- Microsoft disrupts ransomware attacks targeting Teams users — www.bleepingcomputer.com — 16.10.2025 19:58