BleepingComputer reports that Microsoft Teams, Zoom, and other video-conferencing apps could have their Traversal Using Relays around NAT servers exploited for traffic tunneling through the new Ghost Calls post-exploitation command-and-control bypass tactic.
Temporary TURN credentials provided when joining Teams or Zoom meetings could be taken over by Ghost Calls to facilitate the creation of TURN-based WebRTC client that could then be leveraged by attackers to achieve arbitrary data proxying or C2 traffic concealment while benefitting from reliable connectivity, according to a Praetorian study presented at Black Hat USA 2025. Praetorian researchers were able to tunnel traffic through the custom open-source TURNt utility, which includes a Controller for the threat actor that executes a SOCKS proxy server to approve TURN-tunneled connections and a Relay for the impacted host device. Neither Microsoft nor Zoom has disclosed whether more security measures will be implemented to prevent the occurrence of such an intrusion.
![{“remix_data”:[],”remix_entry_point”:”challenges”,”source_tags”:[“local”],”origin”:”unknown”,”total_draw_time”:0,”total_draw_actions”:0,”layers_used”:0,”brushes_used”:0,”photos_added”:0,”total_editor_...](/api/thumbor-proxy?width=1920&src=https%3A%2F%2Ffiles.cyberriskalliance.com%2Fwp-content%2Fuploads%2F2026%2F10%2FAdobeStock_2200439738-scaled.jpeg)
