Phishing Campaigns Weaponize Legitimate RMM Tools for Remote Access and Credential Theft

Threat researchers reported multiple phishing-driven intrusions in which attackers impersonate trusted brands and agencies to trick victims into installing legitimate remote monitoring and management (RMM) software for persistent access. In Operation DoppelBrand, financially motivated actor GS7 spoofed Fortune 500 financial and technology brands (including Wells Fargo and USAA) using more than 150 lookalike domains to harvest credentials and exfiltrate data via attacker-controlled Telegram bots; researchers also identified nearly 200 additional domains with short registration terms, automated SSL, wildcard DNS, and brand-specific subdomains supporting the campaign.

Separately, Forcepoint X-Labs described a wave of emails impersonating the U.S. Social Security Administration that delivers an attached .cmd script to weaken Windows defenses and enable silent installation of ConnectWise ScreenConnect. The script checks/elevates privileges, disables Windows SmartScreen via registry changes, removes Mark-of-the-Web, and uses Alternate Data Streams (ADS) for stealth before installing an MSI and configuring ScreenConnect (via System.config) to beacon to an attacker-controlled server (reported as dof-connecttop on port 8041). Both activity sets highlight a recurring tradecraft pattern: brand impersonation + scripted defense evasion + abuse of legitimate RMM tooling (e.g., LogMeIn Resolve, ScreenConnect) to gain remote control and facilitate follow-on theft or persistence.