A malvertising campaign targets macOS users with a fake Microsoft Teams installer, delivering Atomic Stealer. The attack uses a multi-stage chain with profiling, cloaking domains, and a decoy site to exfiltrate data from infected systems. #AtomicStealer #voipfaqs #teamsbusiness #locallyhyped #MicrosoftTeams #Poseidon #OSXRodStealer
Keypoints
- Malvertising campaign lures Mac users with a fraudulent Microsoft Teams installer.
- Ad traffic may be paid by a compromised Google ad account and can redirect to legitimate-appearing pages before delivering malware.
- The malicious chain uses smart profiling and cloaking domains to separate redirects from the final malicious landing page.
- The cloaking domain is voipfaqs.com and the decoy site is teamsbusiness.org.
- The payload is hosted on locallyhyped.com and delivered as MicrosoftTeams_v.(xx).dmg, with users prompted to bypass protections by right-clicking.
- Post-install, Atomic Stealer exfiltrates data via a single encoded POST to 147.45.43.136.
MITRE Techniques
- [T1189] Drive-by Compromise – Malvertising redirects visitors to a decoy page and delivers a unique payload to each visitor. “Each click is first profiled (smart[.]link) to ensure only real people (not bots, VPNs) proceed, followed by a cloaking domain (voipfaqs[.]com) separating the initial redirect from the malicious landing (decoy) page (teamsbusiness[.]org).”
- [T1036] Masquerading – The display URL shows microsoft.com, but “it has nothing to do with Microsoft at all.”
- [T1204] User Execution – The user is instructed to “enter your password and grant access to the file system.”
- [T1555.003] Credentials in OS Credential Store (Keychain) – The malware aims “to grab keychain passwords and important files.”
- [T1041] Exfiltration Over C2 Channel – Data is exfiltrated via a single POST to “147.45.43[.]136” with the content encoded.
Indicators of Compromise
- [Domain] voipfaqs.com – cloaking domain used to separate initial redirect from landing
- [Domain] teamsbusiness.org – decoy site
- [URL] locallyhyped.com/kurkum/script_66902619887998[.]92077775[.]php – download URL
- [File name] MicrosoftTeams_v.(xx).dmg – downloaded installer payload
- [File hash] 7120703c25575607c396391964814c0bd10811db47957750e11b97b9f3c36b5d – Atomic Stealer payload
- [IP] 147.45.43.136 – Command and control server