Microsoft Teams malvertising campaign (12-12-2025)
- Description: Malicious Google Search ad for Microsoft Teams
- Severity: Medium
- Reporter: Jérôme Segura
- Reported to Google: 12/12/2025
Google Search Ad
Traffic view
Decoy page
Malicious script
IOCs
| Cloaking | hxxps[://]whufast[.]com |
| Fake Teams page | hxxps[://]micsorssotftteamsslive[.]com |
| Payload URL | hxxps[://]ipadvanced[.]s3[.]us-east-005[.]backblazeb2[.]com/applist/MSTeamsSetup[.]exe |
| Payload SHA256 | 977d7959330af8cb27a5dba1b96cb8ecd8b6c48ec809516465d6ada057fcfcd6 |
| C2 | dsbadsf656563[.]site |