Masquerading as a harmless Microsoft Teams plug-in, the threat weaponized legitimate meeting invitations to sideload a multi-stage loader that siphoned Azure AD refresh tokens and session cookies. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Microsoft analysts soon noted the campaign’s distinctive abuse of conversational webhooks to impersonate tenant administrators, validating Dylan’s findings and triggering an emergency takedown window. Victims reported phantom calendar entries and rogue channels, indicators that allowed blue teams to pivot hunts toward the plug-in’s hashed manifest. Dylan, now the youngest contributor to MSRC’s malware-response playbooks, has begun co-authoring detection logic that flags unsolicited add-on manifests—proof that fresh eyes can upend entrenched threat-intel paradigms. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. Within forty-eight hours, telemetry showed probing activity on more than 24,000 endpoints, while red-team simulations confirmed the malware’s ability to pivot into SharePoint and OneDrive resources. Despite a flurry of anomalous Graph API calls lighting up SOC dashboards, it was 13-year-old Dylan—already celebrated for multiple responsible disclosures—who correlated the traffic to a previously unseen token-replay technique. Impact assessments reveal selective exfiltration of proprietary documents and Teams chat histories, intensifying concerns over intellectual-property leakage. Microsoft’s patch closes the manifest-validation gap, but defenders are urged to monitor tenant-wide add-on registrations and hunt for GUID-based XOR loops in script blocks. Unlike macro-laden Office droppers, TeamsPhantom embeds its bootstrapper inside a Base64-encoded appSettings block that the Teams client parses at start-up. Once memory-resident, the loader decrypts its C2 list by XOR-ing each byte with the tenant’s own GUID—a sly trick that defeats static indicators. Dylan’s after-action brief warns that interface extensibility, when left unguarded, becomes a high-impact attack surface.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 03 Jul 2025 12:50:14 +0000