---
title: How Hackers Are Exploiting Microsoft Teams to Spread Malware
description: Discover how cybercriminals exploit Microsoft Teams to spread malware and learn essential strategies to protect your organization from evolving threats.
image: https://buzzmybiz.co/hubfs/AI-Generated%20Media/Images/The%20image%20depicts%20a%20modern%20office%20environment%20where%20an%20employee%20sits%20at%20a%20desk%20engaged%20in%20a%20Microsoft%20Teams%20video%20call%20The%20screen%20shows%20a%20friendly%20seemingly%20helpful%20IT%20support%20figure%20their%20expression%20warm%20and%20inviting%20The%20employee%20appearing%20focused%20y-1.jpeg
---

[Skip to content](https://buzzmybiz.co/blog/how-hackers-are-exploiting-microsoft-teams-to-spread-malware#main-content)

[![Buzz My Biz - Revolutionize your sales team](https://buzzmybiz.co/hs-fs/hubfs/bmb-2025-logo.png?width=200&height=200&name=bmb-2025-logo.png)](https://buzzmybiz.co/)

- [About](https://buzzmybiz.co/#about)
  
  Show submenu for About 
  
    - [Privacy Policy](https://buzzmybiz.co/privacy-policy)
    - [Terms of Use](https://buzzmybiz.co/terms-of-use)
- More Services
  
  Show submenu for More Services 
  
    - [Social Media Marketing](https://buzzmybiz.co/social-media-marketing)
    - [Digital Marketing](https://buzzmybiz.co/digital-marketing)
    - [AI-enhanced CRM](https://buzzmybiz.co/ai-enhanced-crm)
    - [VOIP Phone Systems](https://buzzmybiz.co/voip-phone-systems)

Open main navigation

Close main navigation

- [About](https://buzzmybiz.co/#about)
  
  Show submenu for About 
  
    - [Privacy Policy](https://buzzmybiz.co/privacy-policy)
    - [Terms of Use](https://buzzmybiz.co/terms-of-use)
- More Services
  
  Show submenu for More Services 
  
    - [Social Media Marketing](https://buzzmybiz.co/social-media-marketing)
    - [Digital Marketing](https://buzzmybiz.co/digital-marketing)
    - [AI-enhanced CRM](https://buzzmybiz.co/ai-enhanced-crm)
    - [VOIP Phone Systems](https://buzzmybiz.co/voip-phone-systems)
- [Contact](https://meetings.hubspot.com/buzzmybiz/meet-w-randy)

[Contact](https://meetings.hubspot.com/buzzmybiz/meet-w-randy)

 Jul 19, 2025 8:18:36 AM

# How Hackers Are Exploiting Microsoft Teams to Spread Malware

![Picture of Randy Cooper](https://app.hubspot.com/settings/avatar/c5808e6832ca5d4b1b61053f9a32046d) [Randy Cooper](https://buzzmybiz.co/blog/author/randy-cooper)

![The image depicts a modern office environment where an employee sits at a desk engaged in a Microsoft Teams video call The screen shows a friendly seemingly helpful IT support figure their expression warm and inviting The employee appearing focused y-1](https://buzzmybiz.co/hs-fs/hubfs/AI-Generated%20Media/Images/The%20image%20depicts%20a%20modern%20office%20environment%20where%20an%20employee%20sits%20at%20a%20desk%20engaged%20in%20a%20Microsoft%20Teams%20video%20call%20The%20screen%20shows%20a%20friendly%20seemingly%20helpful%20IT%20support%20figure%20their%20expression%20warm%20and%20inviting%20The%20employee%20appearing%20focused%20y-1.jpeg?width=400&height=400&name=The%20image%20depicts%20a%20modern%20office%20environment%20where%20an%20employee%20sits%20at%20a%20desk%20engaged%20in%20a%20Microsoft%20Teams%20video%20call%20The%20screen%20shows%20a%20friendly%20seemingly%20helpful%20IT%20support%20figure%20their%20expression%20warm%20and%20inviting%20The%20employee%20appearing%20focused%20y-1.jpeg)In July 2025, a sophisticated cyberattack campaign has emerged, leveraging Microsoft Teams to deploy Matanbuchus 3.0, a potent malware loader. This evolved version of Matanbuchus, available as a Malware-as-a-Service  for as little as $2,500 on crime forums, boasts advanced stealth features like improved communication protocols, in-memory execution, and enhanced obfuscation. According to Morphisec, attackers are using social engineering tactics, impersonating IT help desk personnel via Teams calls to trick employees into granting remote access through Quick Assist. This campaign highlights the growing danger of trusted platforms being weaponized, making it critical for organizations to stay vigilant.

#### Social Engineering: The Art of Deception

The attack begins with a cunning social engineering ploy where hackers pose as IT support, contacting employees through external Microsoft Teams calls. By convincing users to launch Quick Assist, attackers gain remote access to deploy a malicious PowerShell script that installs Matanbuchus 3.0. This malware loader can then deliver secondary payloads like Cobalt Strike, DanaBot, or QakBot, which are often precursors to ransomware attacks. The use of legitimate tools like Teams and Quick Assist allows attackers to bypass traditional security measures, exploiting the trust employees place in these platforms. This tactic underscores the need for robust employee training on recognizing phishing attempts.

#### Matanbuchus 3.0: A Malware Powerhouse

Matanbuchus 3.0 is a significant evolution from its predecessors, incorporating features like CMD and PowerShell reverse shell support, and the ability to execute DLL, EXE, and shellcode payloads. Its in-memory capabilities and advanced obfuscation make it particularly difficult for antivirus software to detect. Morphisec’s analysis revealed that the malware’s delivery methods have expanded beyond phishing emails and Google Drive links to include Microsoft Teams as a novel vector. Priced at $15,000 for advanced configurations, this  offering enables even less-skilled cybercriminals to launch devastating attacks, amplifying its threat across industries.

#### Protecting Your Organization from Teams-Based Attacks

To counter this growing threat, organizations must adopt proactive cybersecurity measures. Restricting external Teams calls and limiting the use of remote access tools like Quick Assist to verified scenarios are critical steps. Implementing phishing-resistant MFA and monitoring network traffic for suspicious activity can further reduce risks. Regular audits of cloud configurations and employee training on social engineering tactics are essential to prevent unauthorized access. Microsoft’s recent collaboration security features for Teams, including real-time link and attachment scanning, offer additional protection but require proper configuration to be effective.

#### The Future of Cybersecurity in a Teams-Centric World

As remote work continues to rely heavily on platforms like Microsoft Teams, attackers will likely exploit these tools further, blending social engineering with legitimate software to bypass defenses. The Matanbuchus 3.0 campaign is a wake-up call for businesses to rethink their security strategies, emphasizing layered defenses and user awareness. By combining technical safeguards with ongoing education, organizations can mitigate the risks of such sophisticated attacks. Staying ahead in 2025 demands a proactive approach to securing internal communication platforms, ensuring they don’t become gateways for cybercrime.

SOURCE: [https://thehackernews.com/2025/07/hackers-leverage-microsoft-teams-to.html](https://thehackernews.com/2025/07/hackers-leverage-microsoft-teams-to.html)

## Related posts

[![Risks of SMS-based 2FA and learn how to protect your accounts](https://buzzmybiz.co/hs-fs/hubfs/AI-Generated%20Media/Images/The%20image%20depicts%20a%20darkened%20room%20illuminated%20by%20the%20glow%20of%20multiple%20computer%20screens%20filled%20with%20lines%20of%20code%20and%20data%20streams%20In%20the%20foreground%20a%20person%20sits%20at%20a%20desk%20intently%20focused%20on%20a%20laptop%20their%20face%20partially%20obscured%20by%20the%20shadows%20Surr-1.jpeg?height=200&name=The%20image%20depicts%20a%20darkened%20room%20illuminated%20by%20the%20glow%20of%20multiple%20computer%20screens%20filled%20with%20lines%20of%20code%20and%20data%20streams%20In%20the%20foreground%20a%20person%20sits%20at%20a%20desk%20intently%20focused%20on%20a%20laptop%20their%20face%20partially%20obscured%20by%20the%20shadows%20Surr-1.jpeg)](https://buzzmybiz.co/blog/million-code-heist-why-your-2fa-texts-arent-safe-and-how-to-fix-it)

## [Million-Code Heist: Why Your 2FA Texts Aren’t Safe and How to Fix It](https://buzzmybiz.co/blog/million-code-heist-why-your-2fa-texts-arent-safe-and-how-to-fix-it)

![Picture of Randy Cooper](https://app.hubspot.com/settings/avatar/c5808e6832ca5d4b1b61053f9a32046d) [Randy Cooper](https://buzzmybiz.co/blog/author/randy-cooper) 

 Jun 20, 2025 5:44:05 AM

A Million 2FA Codes Intercepted? Hey there, tech-savvy readers! You might want to sit up for this...

[Read more](https://buzzmybiz.co/blog/million-code-heist-why-your-2fa-texts-arent-safe-and-how-to-fix-it)

[![U.S. offers $10M bounty for info on Iranian hackers](https://buzzmybiz.co/hs-fs/hubfs/AI-Generated%20Media/Images/The%20image%20depicts%20a%20tense%20cybersecurity%20briefing%20room%20illuminated%20by%20harsh%20fluorescent%20lights%20A%20large%20digital%20screen%20at%20the%20front%20displays%20a%20map%20of%20the%20United%20States%20highlighting%20various%20critical%20infrastructure%20locations%20such%20as%20water%20treatment%20plant.jpeg?height=200&name=The%20image%20depicts%20a%20tense%20cybersecurity%20briefing%20room%20illuminated%20by%20harsh%20fluorescent%20lights%20A%20large%20digital%20screen%20at%20the%20front%20displays%20a%20map%20of%20the%20United%20States%20highlighting%20various%20critical%20infrastructure%20locations%20such%20as%20water%20treatment%20plant.jpeg)](https://buzzmybiz.co/blog/u.s.-drops-10m-bounty-on-iranian-hackers-the-iocontrol-malware-threat)

## [U.S. Drops $10M Bounty on Iranian Hackers: The IOControl Malware Threat](https://buzzmybiz.co/blog/u.s.-drops-10m-bounty-on-iranian-hackers-the-iocontrol-malware-threat)

![Picture of Randy Cooper](https://app.hubspot.com/settings/avatar/c5808e6832ca5d4b1b61053f9a32046d) [Randy Cooper](https://buzzmybiz.co/blog/author/randy-cooper) 

 Jun 20, 2025 5:49:04 AM

The U.S. State Department just put a $10 million bounty on the table for info on Iranian hackers...

[Read more](https://buzzmybiz.co/blog/u.s.-drops-10m-bounty-on-iranian-hackers-the-iocontrol-malware-threat)

[![](https://buzzmybiz.co/hs-fs/hubfs/AI-Generated%20Media/Images/The%20image%20depicts%20a%20darkened%20office%20space%20illuminated%20by%20the%20soft%20glow%20of%20a%20computer%20screen.jpeg?height=200&name=The%20image%20depicts%20a%20darkened%20office%20space%20illuminated%20by%20the%20soft%20glow%20of%20a%20computer%20screen.jpeg)](https://buzzmybiz.co/blog/how-email-became-the-top-cyberattack-vector-and-how-to-combat-it)

## [How Email Became the Top Cyberattack Vector and How to Combat It](https://buzzmybiz.co/blog/how-email-became-the-top-cyberattack-vector-and-how-to-combat-it)

![Picture of Randy Cooper](https://app.hubspot.com/settings/avatar/c5808e6832ca5d4b1b61053f9a32046d) [Randy Cooper](https://buzzmybiz.co/blog/author/randy-cooper) 

 Mar 10, 2025 8:55:20 AM

Around 90% of cyberattacks originate through email, with phishing being the primary attack vector....

[Read more](https://buzzmybiz.co/blog/how-email-became-the-top-cyberattack-vector-and-how-to-combat-it)

[![Buzz My Biz - Revolutionize your sales team](https://buzzmybiz.co/hs-fs/hubfs/bmb-2025-logo.png?width=200&height=200&name=bmb-2025-logo.png "Buzz My Biz - Revolutionize your sales team")](https://buzzmybiz.co/)

📍2535 Gate Park Dr, Bethlehem GA 30620  
👔 Office: 678-389-9289  
📱 Mobile: 678-799-0152

![ama-pcm-logo-600x191](https://buzzmybiz.co/hs-fs/hubfs/ama-pcm-logo-600x191.png?width=300&name=ama-pcm-logo-600x191.png "ama-pcm-logo-600x191")

![10-102155_veteran-owned-veteran-owned-business-logo-vector-200x154](https://buzzmybiz.co/hs-fs/hubfs/10-102155_veteran-owned-veteran-owned-business-logo-vector-200x154.png?width=150&height=116&name=10-102155_veteran-owned-veteran-owned-business-logo-vector-200x154.png "10-102155_veteran-owned-veteran-owned-business-logo-vector-200x154")

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Randy Cooper",
    "url" : "https://buzzmybiz.co/blog/author/randy-cooper"
  },
  "dateModified" : "2025-07-19T14:18:59.948Z",
  "datePublished" : "2025-07-19T12:18:36.000Z",
  "headline" : "How Hackers Are Exploiting Microsoft Teams to Spread Malware",
  "image" : [ "https://buzzmybiz.co/hubfs/AI-Generated%20Media/Images/The%20image%20depicts%20a%20modern%20office%20environment%20where%20an%20employee%20sits%20at%20a%20desk%20engaged%20in%20a%20Microsoft%20Teams%20video%20call%20The%20screen%20shows%20a%20friendly%20seemingly%20helpful%20IT%20support%20figure%20their%20expression%20warm%20and%20inviting%20The%20employee%20appearing%20focused%20y-1.jpeg" ],
  "mainEntityOfPage" : {
    "@id" : "https://buzzmybiz.co/blog/how-hackers-are-exploiting-microsoft-teams-to-spread-malware",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://buzzmybiz.co/hubfs/t1-circle(500).png"
    },
    "name" : "TerminusOne.AI Inc"
  }
}
```