Loading story…
Sophos X-Ops reported that a phishing campaign tracked as STAC6405 used invitation-themed lures to trick targets into installing legitimate remote monitoring and management tools, including LogMeIn Resolve and ScreenConnect, giving attackers unattended remote access. The activity was first observed in April 2025, peaked in October and November 2025, and affected more than 80 organizations, primarily in the United States. Sophos said some phishing links were still active at the time of reporting, indicating the campaign may still be ongoing.
In most intrusions, the attackers stopped after establishing remote access, suggesting the operation may support initial access brokerage or maintain dormant persistence for later use. In two cases, however, the compromise advanced to second-stage activity: one intrusion deployed a HeartCrypt-packed infostealer that hid the mouse cursor, injected into csc.exe, contacted 45[.]56.162.138, and stole browser, wallet, and system data; another used a ScreenConnect-based payload bundled with Java components and a likely SimpleHelp-related remote access binary to obtain interactive access before defenders contained the incident.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
At the time of Sophos reporting, some phishing links tied to STAC6405 were still active, indicating the campaign may still have been ongoing. In most observed cases, the attackers stopped after establishing remote access, suggesting possible initial access brokerage or dormant persistence.
The phishing campaign was most active during October and November 2025. Sophos said the activity ultimately affected more than 80 organizations, primarily in the United States.
In a separate incident, the attackers used a ScreenConnect-based payload bundled with Java components and a likely SimpleHelp-related remote access binary to gain interactive access. The customer contained the intrusion before further activity was described.
In one incident following initial remote access, the attackers quickly moved to second-stage activity by deploying a HeartCrypt-packed infostealer. The malware hid the mouse cursor, injected into csc.exe, contacted 45.56.162.138, and stole browser, wallet, and system data.
Sophos X-Ops first saw evidence of the invitation-themed phishing campaign tracked as STAC6405 in April 2025. The lures were used to trick targets into installing legitimate remote monitoring and management tools for attacker-controlled unattended access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
sophos.com
Open sourcekaseya.com
Open sourceblackpointcyber.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported multiple phishing-driven intrusions in which attackers impersonate trusted brands and agencies to trick victims into installing legitimate remote monitoring and management (RMM) software for persistent access. In **Operation DoppelBrand**, financially motivated actor **GS7** spoofed Fortune 500 financial and technology brands (including **Wells Fargo** and **USAA**) using more than **150** lookalike domains to harvest credentials and exfiltrate data via attacker-controlled **Telegram bots**; researchers also identified nearly **200** additional domains with short registration terms, automated SSL, wildcard DNS, and brand-specific subdomains supporting the campaign. Separately, Forcepoint X-Labs described a wave of emails impersonating the **U.S. Social Security Administration** that delivers an attached `.cmd` script to weaken Windows defenses and enable silent installation of **ConnectWise ScreenConnect**. The script checks/elevates privileges, disables **Windows SmartScreen** via registry changes, removes **Mark-of-the-Web**, and uses **Alternate Data Streams (ADS)** for stealth before installing an MSI and configuring ScreenConnect (via `System.config`) to beacon to an attacker-controlled server (reported as `dof-connecttop` on port `8041`). Both activity sets highlight a recurring tradecraft pattern: **brand impersonation + scripted defense evasion + abuse of legitimate RMM tooling** (e.g., *LogMeIn Resolve*, *ScreenConnect*) to gain remote control and facilitate follow-on theft or persistence.
Jun 29, 2026
Forescout disclosed **SeasonalInvite**, a phishing campaign that uses fake seasonal eCard invitations to trick Windows and macOS users into installing legitimate remote monitoring and management (RMM) software, giving attackers persistent remote access without deploying traditional malware. Active since at least January 2026, the operation uses themed lures tied to events such as tax season, Valentine’s Day, and Easter, then routes victims through a traffic distribution system to counterfeit eCard pages that deliver installers tailored to the target operating system. Researchers said the attackers abused commercially signed tools including **ConnectWise ScreenConnect**, **LogMeIn Resolve**, **Kaseya**, and **O&O Syspectr**, helping the activity blend in with trusted software and evade standard trust checks. On macOS, the campaign reportedly paired a signed Kaseya package with a separate configuration file that redirected enrollment to attacker-controlled infrastructure through an unattended deployment feature. Forescout also identified a broad support infrastructure of **959** eCard-themed domains and **2,658** traffic distribution gate pages, along with evidence that parts of the phishing kit and web pages were likely AI-generated.
Jul 16, 2026
Threat actors are abusing the familiarity of **digital invitation and meeting platforms** to increase phishing success rates. Cofense reported malicious *Punchbowl/Paperless Post*-themed invitations that prompt recipients to “log in to view event details,” then redirect to phishing infrastructure offering branded sign-in options (e.g., **Microsoft, Yahoo, AOL, Google, Dropbox**) to harvest credentials. The phishing flow may solicit multiple credential sets by returning fake login errors and urging users to try alternate accounts; submitted credentials are exfiltrated to attacker-controlled domains, often leveraging newly registered domains to evade reputation-based defenses. Separately, Netskope research (reported by KnowBe4) described **fake video meeting invites** for *Zoom, Microsoft Teams, Google Meet,* and similar services that lead to spoofed “join meeting” pages showing purported coworkers already on the call. Victims are instructed to install a required “update” to join; the payload is a **digitally signed remote monitoring and management (RMM) tool** such as *Datto RMM, LogMeIn,* or *ScreenConnect*, enabling remote access and potential follow-on activity including data theft or deployment of additional malware. The use of legitimate, signed RMM software can blend into normal enterprise traffic and may bypass controls where such tools are pre-approved.
Jun 29, 2026