Cato CTRL™ Threat Research: Vishing and Microsoft Teams Used to Deliver PhantomBackdoor

Executive Summary Cato CTRL has discovered a vishing-based delivery technique used against an Italy-based consumer services company associated with PhantomBackdoor, a multi-stage WebSocket-based backdoor previously reported in a Ukraine-focused spear phishing operation by SentinelOne. In SentinelOne’s earlier reporting, initial access relied on phishing lures and a ClickFix-style flow that triggered a staged PowerShell and ended with a WebSocket backdoor. In this…

Diamond Model