Loading story…
Attackers are increasingly leveraging legitimate IT tools and browser features to gain unauthorized access to victims' systems and steal credentials. Recent campaigns have exploited Remote Monitoring and Management (RMM) software such as LogMeIn Resolve (GoToResolve) and PDQ Connect, tricking users into installing these trusted applications under false pretenses. Once installed, these tools provide attackers with full remote access, often bypassing traditional security controls due to their legitimate nature. Attackers distribute these installers through convincing phishing emails and fake websites that mimic popular utility download pages, using legitimate domains like Dropbox to evade detection. The attackers pre-configure the RMM tools with their own identifiers, allowing seamless control over compromised systems.
In parallel, social engineering attacks are evolving to exploit browser features and cloned websites. The ClickFix attack, for example, uses fake ChatGPT Atlas browser installers distributed via cloned sites and sponsored search results to deliver password-stealing malware. Similarly, the Matrix Push C2 platform abuses browser push notifications as a fileless attack vector, tricking users into enabling notifications that deliver fake system alerts and redirect to malicious sites. These techniques rely on the inherent trust users place in familiar brands and browser features, making them highly effective at bypassing both technical and human defenses.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Researchers at BlackFog identified a criminal platform called Matrix Push C2 that uses browser push notifications as a fileless, browser-native social-engineering and command-and-control mechanism. The framework sends fake alerts and redirects users to malware delivery or credential-harvesting pages across desktop and mobile devices.
Researchers reported that government-backed hacking groups linked to Iran, North Korea, and Russia were using the ClickFix method. The campaigns targeted services including student platforms, remote access tools, conferencing services, and AI-related browser tools.
ClickFix attacks expanded through cloned websites and fake installers, including lures such as a fake ChatGPT Atlas browser, to persuade users to paste obfuscated commands into a terminal. The technique was reported as having surged sharply and was being used to deploy password-stealing malware and escalate privileges.
A wave of attacks emerged in which threat actors trick users into installing legitimate remote monitoring and management tools such as LogMeIn Resolve (GoToResolve) and PDQ Connect, often via phishing or fake software pages. Once installed with attacker-controlled configuration, the tools provide stealthy remote access while blending in with normal IT activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
malwarebytes.com
Open sourcehackread.com
Open sourceblog.knowbe4.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported multiple phishing-driven intrusions in which attackers impersonate trusted brands and agencies to trick victims into installing legitimate remote monitoring and management (RMM) software for persistent access. In **Operation DoppelBrand**, financially motivated actor **GS7** spoofed Fortune 500 financial and technology brands (including **Wells Fargo** and **USAA**) using more than **150** lookalike domains to harvest credentials and exfiltrate data via attacker-controlled **Telegram bots**; researchers also identified nearly **200** additional domains with short registration terms, automated SSL, wildcard DNS, and brand-specific subdomains supporting the campaign. Separately, Forcepoint X-Labs described a wave of emails impersonating the **U.S. Social Security Administration** that delivers an attached `.cmd` script to weaken Windows defenses and enable silent installation of **ConnectWise ScreenConnect**. The script checks/elevates privileges, disables **Windows SmartScreen** via registry changes, removes **Mark-of-the-Web**, and uses **Alternate Data Streams (ADS)** for stealth before installing an MSI and configuring ScreenConnect (via `System.config`) to beacon to an attacker-controlled server (reported as `dof-connecttop` on port `8041`). Both activity sets highlight a recurring tradecraft pattern: **brand impersonation + scripted defense evasion + abuse of legitimate RMM tooling** (e.g., *LogMeIn Resolve*, *ScreenConnect*) to gain remote control and facilitate follow-on theft or persistence.
Jun 29, 2026
Multiple cybersecurity incidents have been reported involving the distribution of malware through the abuse of legitimate software and remote management tools. Attackers have exploited platforms such as LogMeIn Resolve, PDQ Connect, and the open-source SteamCleaner utility by disguising malware as legitimate installers or updates. In one case, users were tricked into downloading a malicious version of LogMeIn Resolve or PDQ Connect from websites mimicking legitimate software download pages, resulting in the installation of data-exfiltrating malware. Another campaign involved a backdoor malware signed with a valid certificate and disguised as the SteamCleaner tool, distributed via GitHub repositories and websites offering illegal software. These attacks highlight the increasing sophistication of threat actors in leveraging trusted tools to bypass security controls and gain persistent access to victim systems. The use of legitimate signatures and remote management tools allows attackers to evade traditional security products, as these tools are often whitelisted or considered benign in enterprise environments. Security researchers emphasize the need for enhanced monitoring of remote access tool usage, validation of software sources, and the implementation of behavioral detection mechanisms to identify abnormal activity associated with these tools. The campaigns demonstrate the importance of user awareness and the risks associated with downloading software from unofficial sources, as well as the necessity for organizations to maintain strict controls over the installation and execution of remote management utilities.
Jun 29, 2026
Multiple reports highlight **social engineering and phishing** as primary initial-access vectors, with attackers increasingly targeting **identity systems** rather than exploiting software vulnerabilities. Microsoft was again the most spoofed brand in phishing during Q4 2025 (22% of observed brand-impersonation attempts), reflecting how attackers abuse trust in major identity and productivity platforms to harvest credentials; examples cited include lures mimicking Netflix account recovery, Roblox-related pages, and Spanish-language Facebook scams. Separately, an incident response case described payroll fraud achieved without malware or a network breach: an attacker impersonated employees to help desks, reset passwords, re-enrolled MFA, and registered an external email as an authentication method in **Azure Active Directory**, then altered direct-deposit details to redirect paychecks—underscoring how **help-desk processes and MFA reset workflows** can be exploited for persistence and financial theft. Targeted campaigns also show continued evolution in delivery tradecraft for **remote access**. A spear-phishing operation against Argentina’s judicial sector used ZIP attachments containing a weaponized Windows shortcut (`.lnk`) masquerading as a PDF plus scripts and a decoy court document to deploy a **Remote Access Trojan** while minimizing user suspicion. In parallel, research described **Pulsar RAT** (a Quasar RAT derivative) emphasizing stealth via **memory-only execution** and **HVNC**, with TLS-encrypted C2 and configuration retrieval from public paste sites, alongside persistence mechanisms such as scheduled tasks and UAC-bypass techniques. Another campaign attributed to **Konni APT** (“Operation Poseidon”) abused **Google and Naver ad redirection** (e.g., `ad.doubleclick[.]net`, `mkt.naver[.]com`) to launder clicks through trusted ad infrastructure before landing victims on compromised sites hosting malware, demonstrating how open-redirect and ad-tech trust can bypass reputation-based controls.
Jun 29, 2026