Cyberdudebivash

Got a “Weird” Message on Teams? It Could Be a New Phishing Attack. (Thanks to the “Chat with Anyone” Feature).

CYBERDUDEBIVASH

Author: CyberDudeBivash
Powered by: CyberDudeBivash Brand | cyberdudebivash.com
Related:cyberbivash.blogspot.com

 Daily Threat Intel by CyberDudeBivash
Zero-days, exploit breakdowns, IOCs, detection rules & mitigation playbooks.

Follow on LinkedInApps & Security ToolsAuthor: CyberDudeBivash
Powered by: CyberDudeBivash Brand | cyberdudebivash.com
Related:cyberbivash.blogspot.com

CISO Briefing: Got a “Weird” Message on Teams? It’s an EDR-Bypassing Attack. (A CISO’s Hunt Guide) — by CyberDudeBivash

By CyberDudeBivash · 01 Nov 2025 · cyberdudebivash.com · Intel on cyberbivash.blogspot.com

LinkedIn: ThreatWirecryptobivash.code.blog

TEAMS PHISHING • EDR BYPASS • SESSION HIJACKING • LotL

Situation: Business Email Compromise (BEC) has a new, devastating TTP. Attackers are using Microsoft’s “Chat with Anyone” (external federation) feature in Teams to *bypass* your Secure Email Gateway (SEG). This is a “Trusted Platform” attack.

This is a decision-grade CISO brief. This TTP *exploits human trust*. Your employees are *trained* to trust Teams. The attacker sends a fileless payload (like `resume.pdf.js`). Your EDR (Endpoint Detection and Response) is *blind* to this “Living off the Land” (LotL) attack because it’s a “trusted” `wscript.exe` process. This is the new kill chain for infostealers and MFA-bypassing session hijacking.

TL;DR — Attackers are sending malicious `.JS` files *through Teams chat* to bypass your EDR.

  • The TTP: “Trusted Partner” Hijack. Attacker uses a (stolen or new) external M365 account to send a “weird” Teams chat to your employee.
  • The “SEG Bypass”: The attack *never* touches your email gateway. It is 100% invisible to your email security stack.
  • The “EDR Bypass”: The chat link drops a fileless payload (like `document.pdf.js`). Your EDR is *whitelisted* to trust the `wscript.exe` process that runs it.
  • The Impact: Infostealer (Redline/Vidar) → Session Hijacking (M365/VPN tokens stolen) → Full Enterprise Breach.
  • THE ACTION (CISO):** 1) HARDEN: *De-weaponize `.JS` files*. Change the default handler from `wscript.exe` to `notepad.exe` via GPO. 2) HUNT: This is the mandate. Hunt for the *real* IOC: `wscript.exe -> powershell.exe`.

TTP Factbox: “Trusted Platform” Phish (Teams)

TTPComponentSeverityExploitabilityMitigation
Phishing (T1566.002)Microsoft Teams (External)CriticalBypasses SEG/DMARCPhishRadar AI / GPO Hardening
Fileless Malware (T1059.007)`.JS` File -> `wscript.exe`CriticalEDR Bypass (LotL)MDR (Threat Hunting)

Fileless BackdoorEDR Bypass TTPLiving off the Land (LotL)Contents

  1. Phase 1: The “Trusted Platform” Fail (Why This TTP Works)
  2. Phase 2: The Kill Chain (From “Teams Chat” to Enterprise Breach)
  3. Exploit Chain (Engineering)
  4. Reproduction & Lab Setup (Safe)
  5. Detection & Hunting Playbook (The *New* SOC Mandate)
  6. Mitigation & Hardening (The CISO Mandate)
  7. Audit Validation (Blue-Team)
  8. Tools We Recommend (Partner Links)
  9. CyberDudeBivash Services & Apps
  10. FAQ
  11. Timeline & Credits
  12. References

Phase 1: The “Trusted Platform” Fail (Why This TTP Works)

As a CISO, your Secure Email Gateway (SEG) is hardened. Your Zero-Trust policy is strict. But this TTP bypasses *both*.

This is a “Trusted Platform” attack. The attacker isn’t targeting *you*. They are targeting your *human trust* in your *own collaboration tools*.

Here is the *critical failure* in your security model:

  1. The SEG Bypass: The attack *does not* come via email. It comes as a *Teams Chat* from an “external” user (or a compromised partner account). Your SEG *never sees it*.
  2. The “Human” Bypass: Your employee is *trained* to trust Teams. They are *not* trained to distrust it. When `steve@partner-corp.com` (a trusted partner) sends a Teams message: “Hey, here is the document we discussed. The link is `[…].zip`”, the user *will* click.
  3. The “EDR Bypass”: The link in the message (e.g., “Gootloader” TTP) is a `.ZIP` file. Inside is a `.JS` or `.LNK` file. This is a “Living off the Land” (LotL) attack. Your EDR *trusts* the `wscript.exe` (Windows Script Host) process that runs this file, and is *blind* to the fileless PowerShell payload it executes.

Your “trusted” platform, “trusted” partner, and “trusted” EDR process have all been weaponized against you.

Phase 2: The Kill Chain (From “Teams Chat” to Enterprise Breach)

This is a CISO PostMortem because the kill chain is *devastatingly* fast and *invisible* to traditional tools.

Stage 1: Initial Access (The “Partner” Breach)

The attacker phishes a *partner* (a hotel, a supplier, a law firm) and steals their M365 *session cookie*. (This is a Session Hijack, which our SessionShield app prevents).

Stage 2: The “Trusted” Phish (The “Lure”)

The attacker logs in *as your partner*. They use the *real* M365 account to send a Teams message *from your partner’s trusted domain* to your employee:
`”Urgent: Your payment has been declined. Please download the attached ‘Payment_Confirmation.zip’ and verify your details.”`

Stage 3: Execution (The EDR Bypass)

Your employee, on their corporate laptop, clicks the link. They open `Payment_Details.pdf.js`.
`explorer.exe` → `wscript.exe file.js` → `powershell.exe -e …`
This fileless script (Gootloader, “EndClient” RAT) is now running *in-memory* as a “trusted” process.

Stage 4: Session Hijacking & Data Exfil (The *Real* Breach)

The fileless script is an Infostealer. It *does not* deploy ransomware (that’s “loud”). It *silently* steals:

  • All *active session cookies* for M365, Salesforce, GitHub, etc.
  • All saved `chrome://settings/passwords`.
  • All `~/.aws/` and `~/.ssh/` keys.

The attacker *bypasses MFA* by “replaying” the stolen session cookie. They are now *logged in as your employee* from their C2 server. They begin *exfiltrating* your “crown jewel” PII and IP. You are breached.

Exploit Chain (Engineering)

This is a “Trusted Process” Hijack (T1219/T1059). The “exploit” is a *logic* flaw in your EDR Whitelisting policy.

  • Trigger: User double-clicks `.js` file.
  • Precondition: EDR/AV is configured to *automatically trust* all `wscript.exe` / `cscript.exe` processes. Windows “Hides known file extensions” is ON.
  • Sink (The RCE): `explorer.exe` → `wscript.exe file.js` → `powershell.exe -e …` (Fileless C2)
  • Module/Build: `wscript.exe` (Trusted), `powershell.exe` (Trusted).
  • Patch Delta: There is no “patch.” The “fix” is GPO Hardening (changing the default `.js` handler) and MDR (Threat Hunting).

Reproduction & Lab Setup (Safe)

You *must* test your EDR’s visibility for this TTP.

  • Harness/Target: A sandboxed Windows 11 VM with your standard EDR agent installed.
  • Test: 1) Create a file named `test.js`. 2) Put this *one line* of code in it: `WScript.CreateObject(“WScript.Shell”).Run(“calc.exe”);`
  • Execution: Double-click the `test.js` file.
  • Result: Did `calc.exe` launch? Did your EDR fire a P1 (Critical) alert for `wscript.exe -> calc.exe`? If it was *silent*, your EDR is *blind* to this TTP.
  • Safety Note: If `calc.exe` can run, so can the “EndClient” RAT.

Detection & Hunting Playbook (The *New* SOC Mandate)

Your SOC *must* hunt for this. Your SIEM/EDR is blind to the exploit itself; it can *only* see the *result*. This is your playbook.

  • Hunt TTP 1 (The #1 IOC): “Anomalous Child Process.” This is your P1 alert. Your `wscript.exe` process should *NEVER* spawn a shell (`powershell.exe`, `cmd.exe`, `/bin/bash`).# EDR / SIEM Hunt Query (Pseudocode) SELECT * FROM process_events WHERE (parent_process_name = ‘wscript.exe’ OR parent_process_name = ‘cscript.exe’) AND (process_name = ‘powershell.exe’ OR process_name = ‘cmd.exe’)
  • Hunt TTP 2 (The C2): “Show me all *network connections* from `wscript.exe` or `cscript.exe` to a *newly-registered domain* or *anomalous IP*.”
  • Hunt TTP 3 (The *Result*): “Impossible Travel / Anomalous Session.” Hunt your *cloud* logs (M365, AWS, Salesforce) for a *session hijack*. This is what our SessionShield app automates.

Mitigation: The 5-Step CISO/Consumer Checklist

This is a *hybrid* threat. It requires a *hybrid* defense. This is the CyberDudeBivash 5-Step Checklist.

1. (CISO) HARDEN YOUR ENDPOINTS (The #1 Fix)

This is your CISO mandate. De-weaponize JavaScript files.
You must *change the default file handler* for `.JS` files. An employee should *never* “execute” a `.JS` file. It should *open* in Notepad.
The Fix: Use GPO to change the default handler for `.js` files from `wscript.exe` (Execute) to `notepad.exe` (View). This *kills* the TTP.

2. (CISO) Deploy 24/7 Human-Led MDR

Your EDR is *blind* without a *human hunter*. You *must* have a 24/7 Managed Detection and Response (MDR) team (like ours) to hunt for the `wscript -> powershell` TTPs that your automated tools *will* miss.

3. (CISO) Deploy Session Monitoring (The “Alarm”)

The user *will* be breached. You *must* detect the *session hijack*.
SessionShield is the *only* tool that “fingerprints” your employee’s *real* session. The *instant* an attacker “hijacks” that M365 session from a new IP, SessionShield *kills the session*.

4. (CISO) Harden Teams Federation

Go to your Teams Admin Center and *lock down* “External Access.” Do not allow *all* domains. Change the policy from “Open” to an “Allowlist” of *only* your known, trusted partners.

5. (Consumer/CISO) Deploy Endpoint Security (EDR)

This *entire* attack *starts* with an Infostealer (on the hotel’s PC) or *ends* with one (on your PC). You *must* have a *behavioral* antivirus/EDR that can *block* this fileless TTP.

Recommended Tool: Kaspersky EDR is built to *block* infostealers (like Redline) and *detect* the fileless “PowerShell” TTP *before* your data is stolen.
Get Kaspersky EDR (Partner Link) →

Audit Validation (Blue-Team)

Run this *today*. This is not a “patch”; it’s an *audit*.

# 1. Audit your EDR (The "Lab" Test)
# Run the "Lab Setup" test (`test.js -> calc.exe`). 
# Did your EDR *see* it? If not, it is BLIND.

# 2. Audit your File Handlers
# (Run `ftype JScript.file`)
# Does it say "wscript.exe"? If yes, you are VULNERABLE.
# Run the GPO to change it to "notepad.exe".

# 3. Run the "Lab Test" again
# Did `calc.exe` launch? Or did `notepad.exe` open?
# If Notepad opened, you have *successfully* hardened your fleet.

Is Your EDR Blind to “Fileless” Attacks?
Your SOC is slow. Your EDR is whitelisted. CyberDudeBivash is the leader in Ransomware Defense. We are offering a Free 30-Minute Ransomware Readiness Assessment to show you the *exact* gaps in your “LotL” and “Fileless” defenses.

Book Your FREE 30-Min Assessment Now →

Recommended by CyberDudeBivash (Partner Links)

You need a layered defense. Here’s our vetted stack for this specific threat.

Kaspersky EDR
This is your *sensor*. It’s the #1 tool for providing the behavioral telemetry (process chains, network data) that your *human* MDR team needs to hunt.Edureka — Threat Hunting Training
Your SOC team can’t find what they don’t know. Train them *now* on PowerShell Threat Hunting and LotL TTPs.TurboVPN
The phish often lands on a *remote* device on *public Wi-Fi*. A VPN encrypts this initial access channel.

Alibaba Cloud (VDI)
A key mitigation. Use Virtual Desktop Infrastructure (VDI). If the VDI is popped, you *burn it* and re-image in seconds. The host is safe.AliExpress (Hardware Keys)
*Mandate* this for all Domain Admins. Get FIDO2/YubiKey-compatible keys. They stop the *initial phish* from succeeding.Rewardful
Run a bug bounty program. Pay white-hats to find flaws *before* APTs do.

CyberDudeBivash Services & Apps

We don’t just report on these threats. We hunt them. We are the “human-in-the-loop” that your automated EDR is missing.

  • Managed Detection & Response (MDR): This is the *solution*. Our 24/7 SOC team becomes your Threat Hunters, watching your EDR logs for these *exact* “wscript -> powershell” TTPs.
  • Adversary Simulation (Red Team): This is the *proof*. We will *simulate* this exact “Fileless” Gootloader kill chain to show you where you are blind.
  • Emergency Incident Response (IR): You found this TTP? Call us. Our 24/7 team will hunt the attacker and eradicate them.
  • PhishRadar AI — Stops the phishing attacks that *initiate* the breach.
  • SessionShield — Protects your *admin sessions* from the *credential theft* that happens after this breach.

Book Your FREE 30-Min AssessmentExplore 24/7 MDR ServicesSubscribe to ThreatWire

FAQ

Q: What is the “Booking.com” hack?
A: It’s a “Trusted Partner” Hijack. Attackers *phish* the hotel staff to steal their Booking.com *admin* credentials. They then *log in as the hotel* and use the *official* chat to send malware (like Gootloader) to guests (your employees). This bypasses all email security.

Q: Why doesn’t my Antivirus/EDR block this attack?
A: Because your EDR is *configured to trust* `wscript.exe` and `powershell.exe`. This is a “Trusted Process” bypass. The EDR sees a ‘trusted’ Microsoft process running and *ignores* it. You *must* have a *human* MDR team hunting for the *behavioral* anomalies.

Q: What is the #1 fix for the Gootloader .JS attack?
A: You must HARDEN your endpoints. The #1 fix is to *de-weaponize* JavaScript files. Use a Group Policy (GPO) to *change the default file handler* for `.JS` and `.VBS` files from `wscript.exe` (Execute) to `notepad.exe` (View). This *instantly* neutralizes the threat.

Q: How do I protect my personal data on Booking.com?
A: 1) Use a Virtual Credit Card. 2) *Never* download attachments from a hotel, even on the “real” app. Call the hotel *directly* to confirm any payment issue. 3) Install a *real* antivirus (like Kaspersky) on your PC.

Timeline & Credits

This “Gootloader/BEC 2.0” TTP (T1566.001 / T1059) is an active, ongoing campaign by multiple APTs and RaaS groups.
Credit: This analysis is based on active Incident Response engagements by the CyberDudeBivash threat hunting team.

References

Affiliate Disclosure: We may earn commissions from partner links at no extra cost to you. These are tools we use and trust. Opinions are independent.

CyberDudeBivash — Global Cybersecurity Apps, Services & Threat Intelligence.

cyberdudebivash.com · cyberbivash.blogspot.com · cryptobivash.code.blog

#BEC #Booking #Gootloader #LNKexploit #ZIP #FilelessMalware #PowerShell #EDRBypass #Ransomware #CyberDudeBivash #IncidentResponse #MDR #ThreatHunting #LotL #C2

Leave a comment

Design a site like this with WordPress.com
Get started