Microsoft Teams: Malware Version

How you get hacked: Microsoft Teams: Malware Version. In this video we look at a fake version of Microsoft Teams that can take you to your actual meeting but also connects to a secret server in the background. Try VMRay: go.vmray.com/t... (sponsor)
Buy the best antivirus: thepcsecurityc...
Join the discussion on Discord: discord.tpsc.tech/
Get your business endpoints tested by us: tpsc.tech/
Contact us for business: thepcsecurityc...

[@wolf1438]

I will share this video next time when someone at work will ask me why the office employee cannot install programs on company computers on their own.

[@aussiegruber86]

I work in automation with PLCs etc and our OS is so locked down it takes weeks to have software installed to fix urgent repairs, literally to the point you have customers screaming at you……it’s an absolute joke, I understand that people are hopeless but when these big companies make these stupid blanket rules for engineering task it legit holds everyone back. I have even driven 6 hours to go home to grab a personal laptop so that I could flash a PLC card with the correct firmware.

[@wolf1438]

@@aussiegruber86 would you let some freshmen operator to configure PLC? Tinker with parameter. For example you got value 39 but, he likes rounded numbers so he change them to 40, even when he has warning sign right above PLC controller, DO NOT SET VALUE OVER 39! And as result it cause machine malfunction and several days out of order. What would you explain to the customers? "We let the control panel unlocked so when the alarm goes off, we don't have to input password several times a day?"

[@defenderblack614]

😄 good one

[@LockCarge]

£3200 is a bit steep for a single user! I thought it would be a couple of hundred and was shocked to see the price of vm Ray!

[@r3desired]

Good thing to note is that the real Microsoft Teams does not actually require UAC approval. But, I've also seen companies where the IT departments are the wild west so I wouldn't be surprised if some corporation ran this file lol.

[@GerardPinzone]

Can I ban all software signed in India? If so, how?

[@mukeshsolanki7772]

why do u want to do so??

[@GerardPinzone]

@@mukeshsolanki7772 Why would I ever need to run software signed in India?

[@ТоварищКамрадовСоциалистКоммун]

I'm not aware of anything like this, but there are two other approaches: 1. Make manual control with HIPS/IPS/IDS utilities. 2. Use firewall like Safing Portmaster to ban all traffic to any country that you don't like. It won't save you if bad actor will use VPN or server located in other countries, but it's at least something

[@GerardPinzone]

@@ТоварищКамрадовСоциалистКоммун I already block traffic by country. The question was, can we block signed applications by the country of origin of the certificate?

[@ТоварищКамрадовСоциалистКоммун]

@@GerardPinzone the country of the origin of the certificate is the company that included this indian company in the trusted list. It should be seen if Leo would at 0:30 click on the company name and then press on 'details' button. That would reveal the CA data. About your question looks like rather no. You either use the normal list of CA, or you don't use it ) In fact, the alternative to it is the web of trust. You can edit the CA list, but it's rather a manual control, not what you asked

[@Steven-u5w]

I truly appreciate everything. Put it into this channel. Very interesting and really do need to be aware and on top of the situation at all times it is very easily to get caught out

[@anxiousfool]

Most importantly, I would not expect a UAC prompt when installing Teams, and so would be immediately suspect.

[@fred-youtube]

However any software that installs for all users requires UAC, so not many else would be suspicious.

[@itsbinoyghosh]

Yup ​@@fred-youtube

[@anxiousfool]

@ True! The official Teams installer installs in a user's appdata by default, and only will install for all users if you manually run the installer as an admin. That's why from my experience a Teams installer should only give a UAC prompt if I prompt it to do so.

[@the-Gammaron]

Problem is, you can't really expect the ordinary user to notice and remember such tiny details ​@@anxiousfool

[@russellhltn1396]

Question: what happens if the users don't have admin rights? That's the way we do it at my company.

[@mikumikupog]

That is pretty convincing.. signature would probably give it away for me

[@lifelover69]

Because of IT policy, I have to click that prompt so many times a day, so most people will not read the signature, especially under always-tight deadlines. IT preinstalls Teams via Intune, so this exact malware situation would not happen.

[@13thravenpurple94]

Outstanding work on this video! I'm grateful for your dedication! 🌟

[@xgui4-studios]

the code signing practice is corrupted

[@MikesRecordBox]

What happens if you already have teams installed?

[@peterwassmuth4014]

Awesome! Thank you for Sharing! 💯✴

[@Vik-005]

Microsoft has office in India yet this happens so it means, its a partnership and w11 and recall and account to logged in without logging out deliberately shouts same.

[@RezaQin]

Just another reason why I've only ever gotten a virus by clicking things I shouldn't have...

[@xypha85]

Weird question i guess. Is it the fact i grew up in the 90s as in internet kid that makes me inclined to matter go to an official source or not use it. If a email comes through for anything i always open the site myself. I treat it the same as that if my calls me. I hang up and dial back to my bank so i know its really the bank because i dialled them. Hadnt really thought about it in years till i watched this, its just been habit since i can remeber.

[@mazharul3132]

What will a good behavioral protection AV do in this situation?

[@foqsi_]

Hey! I'm starting a malware analysis course in school. The professor has provided a zipped malware folder on the portal. However, there are no instructions other than do not unzip. I know to not mess with it on my local machine, but I enabled sandbox mode on my PC, but I'm not entirely sure how sandbox works. Is it possible the virus could leak to my local machine from the sandbox?

[@Ohem1]

I've had the same thought about VMs

[@vpx23]

According to the systray icon it's also the old Teams version, not New Teams. ^^

[@Audulf-of-Frisia]

I wish you would a few episodes on mobile threats for Android.

[@animeworld2005]

Mobile threats are very rare if you not download any apks from anywhere

[@ТоварищКамрадовСоциалистКоммун]

yep, as long as you stick to the app store, you are pretty safe

[@lukamanevski]

What about clicking on links​@@ТоварищКамрадовСоциалистКоммун

[@ТоварищКамрадовСоциалистКоммун]

@@lukamanevski links are normally processed by browsers, so it's about how secure the browser is. If you are interested in just security, staying with google products, including chrome, is a safe side. You can still ramp up your security by using some extensions for security and privacy. The top 3 of them: uBO, noscript, bitwarden or keypassxc

[@1nwb-4dnws]

AppManager using virustotal, still need to check the repo manually tho eg false positive solved in breeze weather

[@06dogb]

Surprised people would even need something to install teams. Thought it was automatically installed on windows by default or even if not included it auto installs every time I put fresh Win11 on a PC and connect to internet.

[@graysonpeddie]

You can have your computer infected with malware in Windows 11 as you would in Windows Vista and 7 which are two of my favorite operating systems of all time. Even as far back to Windows XP. It does not matter which version of Windows you are in if you are not vigilant at all.

[@imgamerful]

Unironcially I still use windows xp. Despite being cautious I'm sure my PC is infected, due to there being no decent or working anti viruses for it.

[@Furtivexx]

Do you happen to have an installer for the John miner? Aka ReaItekHD bitcoinminer that blocks a lot of AV software? Know what I’m referring to?

[@Techgrove333]

Can these malwares get pass a antivirus program like estefy?

[@NO-END]

What 4 AV engines detected it??

[@imgamerful]

I'm willing to bet Bitdefender or ESET caught it. Maybe Kaspersky too

[@reasonabledoubt-z9q]

Is an antimalware like Bitdefender effective at analyzing attachments and executable? It does have a function to do this

[@IamLookingforWoody_________786]

Nice video😘💐👌🏼.

[@VORTEX_OMB]

1:09 WHAT WE COULD IMAGINE? IMAGINE IF NINJA GOT A LOOOOOW TAPER FAADE 🗣🗣🗣🗣

[@paullopresti9568]

Is there any recent malware on Pot Player or VLC media player. I downloaded both and something made my laptop and router unusable. USB ports don't work. Command prompt doesn't work. Can't open file Explorer, and it won't let me wipe the drive. Router won't connect to the internet. I tried to log onto the router, but my password didn't work. I did a factory reset, and the default user/password doesn't work. I also tried everything in safe mode. Any ideas on what to do?

[@ТоварищКамрадовСоциалистКоммун]

solving an issue starts from localizing it. First to do is to find out what doesn't work. It's not likely that both your gadget (PC?) and router are affected because of possible malware. If you don't have any other PCs, get a linux from your flash stick, load from it, and check if router is OK. Oh, you don't have any linux on a flash drive? what a shame

[@ТоварищКамрадовСоциалистКоммун]

it might be that your system doesn't work properly. You need first to stop using your possibly infected system and find something that you can rely on. If not another laptop, then at least another system loaded from it. Desirably some linux from a flash drive. Ask your friends/ neighbors to make it for you

[@ТоварищКамрадовСоциалистКоммун]

when router will be working again, fix your laptop. Safe way is to reinstall your system. Your laptop may have a system backup sector, you can use it to restore your system

[@empmachine]

BonziBuddy comeback time!!

[@ProtoType4588]

even if its the business i do not care emails with attachments standardly gets verified in a vm if its a well known program i will download it from the source itself people go ow but it aint as convenient...are you that lazy to open the browser and find microsoft teams on the microsoft site heck why even a browser run the windows store instead it also has microsoft teams

[@ConfuseDoc]

Hello what antivirus software do you use personally?Thanks for reply 🙂

[@Fugalism]

Microsoft's Defender is fine. Just don't open executables you shouldn't be opening to begin with.

[@bomlife1572]

@@Fugalism "Just don't open executables you shouldn't be opening to begin with." lol

[@FSK1138]

? . it is not from microsoft ...? why would you run this ?? just download teams from Microsoft .😆

[@IgnacioGouk]

The level of tech illiteracy in the average office would blow your mind..

[@eainen]

perhaps consider watching the video

[@ppiero7]

👍👍👍

[@ethimself5064]

Seems like my Comment disappeared. I believe it was noteworthy

[@Daeva83B]

I think i got hacked, not sure how exactly, still figuring that out. Using ubuntu clamscan now to scan and figure out the infection. Either game mods, or in my crusade on twitter, because a guy sended me a soundfile, he was pretending to be elon, and I said proof it and without thinking i clicked on the play button. My pc is still scanning for the infection and i just wanna identify it. I want to know what it is. Thank you btw, your videos informed me well.

[@Nippell]

nice 20 seconds of the video bro❤

[@LaProUserniere]

Versions: Team personal Team proffesional Random asian team..

[@mackjsm7105]

TY bd

[@preveenramcharan]

The worst thing to do on Windows 11: align the icons to the left 🤦‍♂

[@iamwitchergeraltofrivia9670]

Hhahahaha more malware update not new

[@lewiskelly14]

Half baked video

[@ooparkeroo]

first

[@patriotic1526]

goons. thats how