28/12/2025
đĄď¸ Microsoft recently stopped a major ransomware campaign⌠and it all started with fake Teams installers.
Now this is a story that shows just how creative (and dangerous) cyber criminals have become. And how quickly Microsoft is moving to fight back.
Back in October, Microsoft quietly disrupted a wave of ransomware attacks that were spreading through fake Microsoft Teams downloads.
A group known as Vanilla Tempest (also tracked as Vice Society or VICE SPIDER) had been tricking people into downloading a file called âMSTeamsSetup.exeâ from websites that looked almost identical to the real Teams download page.
The sites had names like:
đľď¸ââď¸ teams-install[.]top
đľď¸ââď¸ teams-download[.]buzz
All designed to look just convincing enough to fool busy workers.
But instead of installing Teams, the fake file secretly loaded a piece of malware called Oyster. A backdoor that gave hackers remote access to victimsâ devices.
Once inside, they could steal data, run commands, or install Rhysida ransomware, locking down entire systems for ransom.
Thankfully, Microsoft caught on fast. They revoked over 200 digital certificates that were being used to make these fake installers appear legitimate, effectively cutting off the hackersâ ability to keep spreading their malware.
This is a big win, but itâs also a reminder. The front line of cyber crime is constantly moving.
Attackers arenât just sending suspicious links anymore, theyâre using malvertising (fake ads in search results), SEO poisoning (making malicious sites appear higher on Google), and trust exploitation (abusing real code-signing certificates).
And because the attacks looked like official Microsoft software, many victims didnât think twice before downloading.
Hereâs the takeaway đ
Even trusted tools like Teams can be used against you when attackers get clever.
The best defence is cyber awareness and vigilance.
â
Always download apps directly from official sources
â
Keep your security software and OS up to date
â
Train your team to question anything that looks âslightly offâ
Microsoft did their part by shutting this one down. But the next campaign could already be brewing.
đŹ Have you ever spotted (or fallen for) a fake version of a trusted tool online? Itâs scary how real they look now, isnât it?