Skip to content
Rhysida Ransomware Gang Uses Fake Microsoft Teams Ads to Infect Users

Rhysida Ransomware Gang Uses Fake Microsoft Teams Ads to Infect Users

First seen 2 Nov 2025, 16:57 UTC • •

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •March 12, 2026 at 13:27 UTC

The Rhysida ransomware gang is exploiting fake ads for Microsoft Teams to distribute malware. Users searching for Microsoft Teams may encounter these deceptive links, which lead to data exfiltration or encryption demands. This campaign targets individuals, schools, and small businesses, leveraging a ransomware-as-a-service model.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 228d ago How this analysis works

More articles in this cluster (3)

Following this threat?

Track Rhysida and Broomstick in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed