Spam floods precede fake IT-support chats in Microsoft Teams
Arctic Wolf documented more than 400 cases; remote-access tools can be installed in under 15 minutes, sometimes leading to ransomware.
64
- Mentions · 7d3
- Mentions · 30d3
- All mentions7
- First seenAug 18, 2026
- Last mentioned3d ago
Timeline
7 articles · newest firstFake Microsoft Teams IT support used for remote access and malware
Arctic Wolf tied more than 400 cases to external chats, inbox floods, and tools such as Quick Assist, sometimes within 15 minutes.
76
Teams IT-support impersonation used to deploy malware and ransomware
Arctic Wolf ties hundreds of cases to throwaway Microsoft 365 tenants, mail bombing, RMM tools, and sometimes Chaos ransomware.
74
Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware
Huntress tracked fake GTA 6 downloads distributing NJRAT, DCRAT, Mercurial Grabber, and Chaos ransomware used as a wiper against gamers.
45
Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers
Huntress found fake GTA 6 installer ISOs spreading NJRAT, DCRAT, Mercurial Grabber and a Chaos ransomware wiper that steals credentials.
47
Fake GTA 6 download delivers malware-packed bundle to impatient gamers
Huntress found malware disguised as a leaked GTA 6 download bundling NJRAT, DCRAT, an infostealer, and Chaos ransomware used as a wiper.
45
New Chaos Variant Targets Misconfigured Cloud Deployments, Adds SOCKS Proxy
Darktrace says the Chaos botnet now targets misconfigured cloud deployments like Hadoop and added a SOCKS proxy for traffic relaying.
40
Appears with
- Quick Assistproduct · 3
- AnyDeskproduct · 3
- DCRATmalware · 3
- Microsoftvendor · 3
- NJRATmalware · 3
- Grand Theft Auto VIproduct · 3
- Mercurial Grabbermalware · 3
- Microsoft Teamsproduct · 3
- ScreenConnectproduct · 3
- Huntressorganization · 2
- TeamViewerproduct · 2
- Sophosorganization · 2
- Arctic Wolforganization · 2
- Huntressvendor · 2
- Rockstar Gamesvendor · 2
- Black Bastathreat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.