Threats · 235 days ago

Microsoft Teams phishing installs A0Backdoor in finance, healthcare

Observed victims include financial and healthcare organizations. The payload arrives as signed MSI and a sideloaded hostfxr.dll, fingerprints hosts, and uses DNS for C2.

Timeline

• Mar 9 Reported by BleepingComputer

Sources

1 source covering this story

• BleepingComputer Mar 9

  Microsoft Teams phishing targets employees with A0Backdoor malware

  Hackers contacted employees at financial and healthcare organizations over Microsoft Teams to trick them into granting remote access through Quick Assist and deploy a new piece of malware called A0Backdoor.

Vendor digest: Microsoft

Part of the PlainSec briefing for 2026-03-10

Editions

• Briefing for 2026-03-10

Related stories

• APT28 conducts long-running surveillance of Ukrainian military
• Scammers impersonate city officials to steal permit fees