Listen to this Post
The Silent Weapon Inside Your Video Calls
A new cyber technique called “Ghost Calls” is rewriting the rules of post-exploitation stealth. Revealed at BlackHat USA by Adam Crosser, a security researcher at Praetorian, this method allows attackers to blend command-and-control (C2) traffic into legitimate Zoom and Microsoft Teams communications, effectively evading firewalls, proxies, and even TLS inspection. Unlike many attack vectors that rely on exploiting vulnerabilities, Ghost Calls abuses the TURN protocol (Traversal Using Relays around NAT) — a critical element used in video conferencing infrastructure — to tunnel malicious traffic through trusted, enterprise-grade servers.
The brilliance of this approach lies in its subtlety. Attackers use real, temporary credentials issued by conferencing platforms to create WebRTC tunnels. These tunnels mimic legitimate traffic, making detection nearly impossible without deep-level monitoring. With Crosser’s custom tool called TURNt, red teamers and threat actors alike can now establish hidden VNC sessions, exfiltrate data, and run remote port forwarding, all under the guise of a “normal meeting in progress.” The code is even available on GitHub, escalating the urgency for enterprise defenders to rethink their detection models.
Ghost Calls: Covert Tunneling Disguised as Online Meetings
A New Level of C2 Camouflage
Security researcher Adam Crosser introduced a method that utilizes TURN servers commonly integrated into video conferencing platforms like Zoom and Microsoft Teams. Known as Ghost Calls, the technique doesn’t exploit any vulnerability — instead, it leverages standard functionalities within these apps to mask malicious activity.
By exploiting WebRTC protocols and the TURN networking standard, attackers can embed C2 communications directly into enterprise-sanctioned traffic. When a user joins a Zoom or Teams meeting, the service grants them temporary TURN credentials. Ghost Calls takes over this session to establish a WebRTC tunnel, relaying command-and-control data through legitimate infrastructure — specifically, trusted servers from Zoom or Teams.
Why Ghost Calls Work So Well
Most corporate defenses allow traffic to and from Zoom or Teams, assuming it’s safe. This trust is what Ghost Calls abuses. The traffic travels through recognized domains and IP addresses, using end-to-end encrypted WebRTC traffic, making inspection nearly impossible without breaking encryption. And because it’s real-time and low-latency, this method supports complex C2 actions like remote control (VNC), data theft, and port forwarding.
The tool enabling this is called TURNt, an open-source utility split into two parts: a Controller (attacker side) and a Relay (compromised machine). The Controller accepts incoming proxy connections via SOCKS, while the Relay connects using TURN credentials to create a WebRTC data channel. The result is a covert and high-speed tunnel masquerading as a legitimate video call.
No Exploits, Just Abuse of Functionality
What makes this method especially dangerous is that it doesn’t exploit bugs — it abuses expected behavior of well-known services. That makes it not only hard to detect, but also harder to fix. Organizations can’t simply block Zoom or Teams traffic without disrupting productivity. As Crosser emphasized, the blending of malicious data into typical meeting traffic is near invisible, mimicking everyday network behavior in real-time.
As of now, Zoom and Microsoft have not responded to inquiries about introducing new protections, despite the high risk. This attack method is gaining attention as it allows for stealth operations in corporate environments where traditional backdoors and C2 channels are routinely blocked or flagged.
What Undercode Say:
Real-Time Traffic as a Weapon: A New Age of Stealth Attacks
Ghost Calls represents a seismic shift in post-exploitation strategy. Rather than relying on vulnerabilities, attackers now exploit the blind trust organizations have in widely-used applications. This is the evolution of cyber evasion — not breaking in through the backdoor, but walking straight through the front gate dressed like a Zoom call.
The genius lies in the method’s dual use of legitimacy and latency. Traditional C2 channels often rely on HTTP/S or DNS tunneling, which introduce detectable anomalies in timing, traffic volume, or endpoint communication patterns. Ghost Calls, on the other hand, piggybacks on live conferencing traffic that’s already encrypted, constant, and allowed by almost every corporate firewall. That makes it an almost perfect cover.
With TURNt now publicly available, this tactic
From an enterprise defense perspective, the hardest challenge is visibility. Security tools aren’t trained to inspect or log WebRTC channels deeply. And doing so would require breaking TLS or man-in-the-middle inspection on trusted platforms like Zoom — a move many companies will resist due to privacy and performance concerns.
Another alarming detail is the protocol flexibility this method provides. TURNt supports both TCP and UDP, including on port 443 — the same port HTTPS uses. That means even deep packet inspection tools may not catch this behavior unless they’re specifically trained to identify TURN/WebRTC anomalies. Given the ever-growing number of remote and hybrid workers relying on conferencing tools, this tactic has vast exploitation potential.
But
We’re entering a phase where abuse of trusted services is the dominant playbook for attackers. Ghost Calls just confirms what many cybersecurity analysts have feared: If it’s encrypted, sanctioned, and widely used — it’s now a viable C2 channel.
🔍 Fact Checker Results:
✅ Ghost Calls uses legitimate TURN servers — no exploit involved.
✅ TURNt is publicly available on GitHub, confirming real-world usage.
❌ No vendor-side mitigations from Zoom or Teams have been announced yet.
📊 Prediction:
👀 Ghost Calls will likely become a mainstream tool in red teaming and advanced persistent threat (APT) operations within the next year.
🛡️ Enterprises will be forced to rethink how they inspect “trusted” traffic, potentially moving toward zero-trust inspection for even sanctioned services.
🚫 Expect Zoom and Teams to announce countermeasures or credential validation updates in response to increasing awareness of this threat.
🕵️📝✔️Let’s dive deep and fact‑check.
References:
Reported By: www.bleepingcomputer.com
Extra Source Hub:
https://stackoverflow.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon
