Executive Summary
In early 2026, the Iranian-linked threat actor Seedworm (also known as MuddyWater) launched a campaign targeting global organizations by impersonating IT support staff on Microsoft Teams. Using deceptive domains like seqhelpsitdevsupportops[.]onmicrosoft.com, attackers convinced users to execute a malicious MSI installer masquerading as a Windows update.
The attack is technically notable for its use of Deno, a legitimate JavaScript runtime, to execute highly obfuscated, in-memory payloads (DINODANCE) to minimize disk footprints. Command-and-control infrastructure for this campaign showed direct overlaps with previously reported MuddyWater activity, confirming the persistent use of social engineering and dual-use tooling by Iranian nation-state actors.
This campaign highlights a shift from traditional email-based phishing to collaboration platforms, requiring SOC teams to expand monitoring to external communication channels. The use of revoked certificates and legitimate system runtime binaries like deno.exe underscores the group's ability to bypass standard signature-based defenses.