In order to ensure that PII and/or configuration data, such as Wi-Fi, WPA, PSK, etc., are deleted from the devices before they are sold or transferred to another party. Heiland said it is essential to “create policies and procedures to manage the de-acquisition of medical technology.”

Maintain tight physical security in and around medical facilities that house MedTech devices and facilities accessing to biomedical networks. Implement network segmentation for all biomedical networks to prohibit communication between MedTech devices and other public or commercial networks.”

Overall, the GIFShell attack method makes use of a number of Microsoft Teams bugs and weaknesses:

  • External users can send Microsoft Teams users attachments by getting around the security measures in place.
  • Change sent attachments to direct users to an external URL rather than the produced SharePoint link for file downloads.
  • Use malicious executables or documents to download by spoofing Microsoft teams attachments to look like safe files.
  • Insecure URI systems enable NTLM Relay attacks or SMB NTLM hash theft.
  • NTLM Relay attacks or SMB NTLM hash stealing is made possible by insecure URI systems.
  • Microsoft does not scan the byte content of HTML base64 encoded GIFs, but it does permit sending them. This enables the delivery of malicious commands inside a GIF that appears to be benign.
  • Microsoft tracks Teams messages in a parsable log file that is read by a user with limited privileges and is keeps locally on the victim’s machine.
  • GIFs are retrieved by Microsoft servers from other servers, enabling data leakage through GIF filenames.

GIFShell – a reverse shell via GIFs

Bobby Rauch, a cybersecurity expert, and pentester, revealed multiple holes in Microsoft Teams that may be chained together for command execution, data exfiltration, security control bypasses, and phishing attacks. This led Rauch to the discovery of the new GIFShell attack chain.

This attack’s primary tool is referred to as “GIFShell,” and it enables an attacker to build a reverse shell that sends malicious commands via base64-encoded GIFs in Teams. This exfiltrates the output using GIFs retrieved by Microsoft’s own infrastructure.

The attacker must first persuade a user to install a malicious stager that runs commands and uploads command output via a GIF URL to a Microsoft Teams webhook in order to construct this reverse shell. Rauch developed a novel phishing attack on Microsoft Teams to help with this, which we discuss in the next part. As we all know, phishing assaults are effective at infecting devices.

The stager, a malicious executable used by GIFShell, is tricked into launching on a user’s device, where it then continuously scans the Microsoft Teams logs. at $HOME\AppData\Roaming\Microsoft\Teams\IndexedDB\\*.log.

Microsoft Teams log folder Source
Microsoft Teams log folder Source: BleepingComputer

viewable by all Windows user groups.

A threat actor builds own Microsoft Teams tenant after installing the stager. After installing he gets in touch with other Microsoft Teams users outside their organization. Attackers can easily accomplish this since Microsoft Teams by default permits external communication.

Rauch’s GIFShell Python script enables the threat actor to send a message to a Microsoft Teams user that contains a GIF for starting attack. This GIF file was altered to add instructions to run on the target’s computer.

The message and the GIF will be saved in Microsoft Team’s logs when the victim receives them, which stager watches.

The base64-encoded commands will be extracted by the stager and run on the device when it recognizes a message that contains a GIF. The output of the command will subsequently be converted to base64 text by the GIFShell PoC.

The attacker’s public Microsoft Teams webhook is accessed by the stager using this base64 text as the filename for a remote GIF placed in a Microsoft Teams survey card.

Microsoft’s servers will link back to the attacker’s server URL when Microsoft Teams creates flashcards for the user in order to get the GIF, which has been named using the base64-encoded output.

When Microsoft tries to obtain the GIFs, the threat actors might keep sending more GIFs with further embedded commands to run and continue to receive the output.

Security software won’t notice the traffic because it comes from the Microsoft domain,, which is used for normal Microsoft Teams communication.

By faking real Microsoft Teams network traffic as the output of their commands, the GIFShell exploit is able to stealthily exfiltrate data.

Even worse, because Microsoft Teams operates in the background, the user doesn’t even have to access it in order for the attacker’s commands to be carried out.

The Microsoft Teams logs folder has also been discovered to be accessed by other software, including malware and commercial monitoring tools like Veriato.

Microsoft does not patch defects right away

In May and June of 2022, according to Rauch, he reported the defects to Microsoft, which acknowledged them as legitimate problems but decided not to immediately address them.

We weren’t shocked by Microsoft’s response when BleepingComputer asked why the issues weren’t corrected. Because the GIFShell attack method necessitates the device is already infected with malware.

“Users should exercise good computing practices online, including vigilance when clicking on links to web pages, opening unexpected files, or allowing file transfers. This type of phishing is crucial to be aware of.

The two techniques described do not pass the test for immediate security repair, according to our evaluation of the methods mentioned by this researcher. A Microsoft representative said, We’re always is exploring innovative ways to better combat phishing to help maintain customer security, and we may take action in a future release to assist minimize this approach.

We were, however, astonished that Microsoft did not think it necessary to address the capability of external attackers to circumvent security measures and send attachments to another tenant.

It was also unexpected that the ability to modify JSON attachment cards, which could have been used to trick Microsoft Teams recipients to download files from remote URLs, wasn’t fixed right away.

However, Microsoft has left the possibility of correcting these problems open, indicating to BleepingComputer that they might be addressed in subsequent releases.

Microsoft clarified to BleepingComputer in a statement that “certain lower severity vulnerabilities. These don’t pose an immediate danger to users are not prioritized for an immediate security update. But will be considered for the next version or release of Windows.”