Fake Microsoft Teams and Google Meet Downloads Spread Oyster Backdoor

The Oyster backdoor (also known as Broomstick) is targeting the financial world, using malicious search ads for PuTTY, Teams, and Google Meet.

Cybercriminals are tricking users into downloading malware disguised as popular office tools like Microsoft Teams and Google Meet. This dangerous campaign is mainly targeting those in the financial world and has been active since mid-November 2025, according to a new report from cybersecurity experts at CyberProof.

The danger lies in what experts call SEO poisoning and malvertising. For your information, in SEO poisoning, attackers manipulate search results to make fake, dangerous websites appear at the top, whereas malvertising means using online advertisements to spread malware.

The Bait: Fake Downloads

CyberProof’s research, shared with Hackread.com, reveals that the attack starts with directing victims to malicious websites. Once a user clicks, they are tricked into downloading the Oyster backdoor (also called Broomstick and CleanUpLoader), first spotted in September ...