Oyster
Oyster, also referred to as Broomstick, CleanUpLoader, and OysterLoader, is a Windows backdoor/loader described as a modular, multistage implant. Reported capabilities include establishing persistent remote access, initiating command-and-control communications, collecting host-level information, supporting host data exfiltration, enabling remote code execution, and delivering additional payloads. Multiple reports state that Oyster has been used to facilitate follow-on deployment of Rhysida ransomware.
Observed delivery vectors include trojanized or counterfeit installers for Microsoft Teams, Google Chrome, and other popular software, often distributed via malvertising, fake download pages, search manipulation, SEO poisoning, and compromised websites. In one documented pattern, fake Microsoft Teams installers deployed Oyster directly; other reporting notes earlier campaigns used a dedicated loader before shifting to direct deployment. PowerShell scripts were used in some intrusions for evasion and persistence, and legitimate Microsoft Teams software was also installed to reduce suspicion. A recruiter-themed campaign targeting job seekers used a fake Microsoft Teams update page on a compromised WordPress site to deliver a payload assessed with high confidence as Oyster/Broomstick-related.
Oyster is repeatedly linked in the content to ransomware and cybercrime ecosystems involving Rhysida and Vanilla Tempest, and to malware-signing abuse by Fox Tempest. Microsoft reported that Fox Tempest’s malware-signing-as-a-service operation signed Oyster samples with fraudulently obtained short-lived Microsoft-issued certificates, causing Windows to initially treat the malware as legitimate software and helping it bypass security controls. The service was also linked to broader campaigns involving Lumma Stealer, Vidar, and ransomware families including Rhysida, Akira, INC, Qilin, and BlackByte. Microsoft additionally observed Storm-3075 distributing Oyster in AI-themed malvertising activity alongside Vidar, Lumma Stealer, and Hijack Loader.
High-confidence infrastructure and indicators mentioned in the content include the domain scs-techresources[.]com as a Broomstick payload delivery domain associated with Rhysida; the Fox Tempest signing platform signspace[.]cloud; the C2/download domain brokeapt[.]com in a related signed-malware chain; and a documented fake Teams update delivery URL on compromised site eai-jo[.]com/es-us.microsohtramsupdate. The content also notes that Oyster/Broomstick commonly uses fake MSTeamsSetup.exe installers and may deploy a backdoor DLL named CaptureService.dll that establishes command-and-control and enables credential theft.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
12 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
While the example campaign described in this section delivered Vidar Stealer, we have also observed this campaign distributing Lumma Stealer, Hijack Loader, and Oyster.
The lawsuit targets Fox Tempest’s infrastructure and also names Vanilla Tempest as a co-conspirator, a prominent ransomware group that used the service to deploy malware like Oyster, Lumma Stealer, and Vidar, and ransomware, including Rhysida, in multiple recent cyberattacks.
The service had been used to sign and distribute malware, including Rhysida ransomware, Oyster, Lumma Stealer, and Vidar, making malicious software appear legitimate and easier to deliver at scale.
The service had been used to sign and distribute malware, including Rhysida ransomware, Oyster, Lumma Stealer, and Vidar, making malicious software appear legitimate and easier to deliver at scale.
The service had been used to sign and distribute malware, including Rhysida ransomware, Oyster, Lumma Stealer, and Vidar, making malicious software appear legitimate and easier to deliver at scale.
Fox Tempest’s operation — which included an authenticated portal and a drag-and-drop feature for rapid code signing — was directly linked to dozens of malware families, including Oyster, Lumma Stealer, MuddyWater, and Vidar.
Techniques & procedures
17 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
1 technique
Reconnaissance
Ransomware operators and other threat groups primarily deployed these fraudulent certificates in ads or SEO poisoning, which brought their malicious software and infostealers to the top of search rankings, ensnaring unsuspecting victims who thought they were downloading and running legitimate applications.
Resource Development
3 techniques
Resource Development
Since at least early 2026, Microsoft Threat Intelligence has observed malvertising campaigns that use AI-themed terms such as “Awesome AI Windows Plugin” and “Flux Pro AI” in social engineering lures ... Microsoft attributes this malvertising activity to an initial access broker and malware distributor tracked as Storm-3075.
Further analysis revealed that Fox Tempest expanded its offerings earlier this year by providing customers with pre-configured virtual machines hosted through Cloudzy infrastructure. Users could upload malware to these systems and receive digitally signed binaries generated through certificates controlled by the group.
Initial Access
1 technique
Initial Access
Execution
3 techniques
Execution
...attacks also entailed the installation of legitimate Microsoft Teams software and a PowerShell script to evade detection and ensure persistence...
Stealth
3 techniques
Stealth
Defense Impairment
2 techniques
Defense Impairment
The operation enabled cybercriminals to sign malicious software with fake trusted certificates, making it appear legitimate and easier to distribute.
Microsoft has announced the disruption of a large-scale malware-signing-as-a-service (MSaaS) operation that exploited its Azure Artifact Signing platform to generate fraudulent code-signing certificates... The group allegedly abused Microsoft's Artifact Signing service to create short-lived digital certificates that allowed malware to appear legitimate to both users and operating systems.
Credential Access
1 technique
Credential Access
Discovery
1 technique
Discovery
IOCs tracked for this family
106 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
89 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A payload associated with Rhysida delivery infrastructure, referenced via a payload delivery domain and a Donut-packed sample.
Malware family observed as an additional payload distributed in the same AI-themed malvertising ecosystem.
Named malware payload observed in the same Storm-3075 AI-themed malvertising distribution campaigns.
Oyster was distributed as fraudulently signed malware through the abused Azure Artifact Signing service. In the described campaign, a fake Microsoft Teams installer delivered a malicious loader that installed Oyster, which ultimately led to deployment of Rhysida ransomware.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.