Loading story…
Check Point Research reported malware observed in the wild using a corporate mobile device management (MDM) platform as an attack vector, turning a trusted enterprise administration channel into a delivery mechanism for malicious activity on managed mobile devices. The finding highlighted how attackers could exploit the high level of trust and control granted to MDM systems to push harmful configurations or software through infrastructure normally used for legitimate device enrollment, policy enforcement, and application deployment.
The report underscored the risk to organizations that rely on MDM to secure employee smartphones and tablets, because compromise or abuse of that management layer can give attackers broad reach across corporate mobile fleets. By leveraging enterprise management tooling rather than traditional phishing or rogue app distribution alone, the campaign demonstrated that mobile security programs must also protect backend administration systems and monitor MDM activity for signs of unauthorized or malicious use.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Check Point Research published findings describing malware observed in the wild that abused a corporate mobile device management (MDM) platform as an attack vector. The report indicates a real-world campaign leveraging enterprise mobile management infrastructure to target devices.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple cybersecurity incidents have been reported involving the distribution of malware through the abuse of legitimate software and remote management tools. Attackers have exploited platforms such as LogMeIn Resolve, PDQ Connect, and the open-source SteamCleaner utility by disguising malware as legitimate installers or updates. In one case, users were tricked into downloading a malicious version of LogMeIn Resolve or PDQ Connect from websites mimicking legitimate software download pages, resulting in the installation of data-exfiltrating malware. Another campaign involved a backdoor malware signed with a valid certificate and disguised as the SteamCleaner tool, distributed via GitHub repositories and websites offering illegal software. These attacks highlight the increasing sophistication of threat actors in leveraging trusted tools to bypass security controls and gain persistent access to victim systems. The use of legitimate signatures and remote management tools allows attackers to evade traditional security products, as these tools are often whitelisted or considered benign in enterprise environments. Security researchers emphasize the need for enhanced monitoring of remote access tool usage, validation of software sources, and the implementation of behavioral detection mechanisms to identify abnormal activity associated with these tools. The campaigns demonstrate the importance of user awareness and the risks associated with downloading software from unofficial sources, as well as the necessity for organizations to maintain strict controls over the installation and execution of remote management utilities.
Jun 29, 2026
Sophos reported that some Android devices were delivered to users with malware already embedded at the firmware level, indicating compromise somewhere in the device supply chain rather than through a typical post-sale infection. Because the malicious code resides below the application layer, it can survive resets, evade standard mobile security controls, and give attackers persistent access to the device. The finding raises concerns for enterprises that rely on Android endpoints for corporate access, especially where bring-your-own-device and low-cost handset procurement are common. Preinstalled firmware malware can expose credentials, communications, and managed applications from the moment a device is activated, making hardware sourcing, mobile threat defense, and strict device attestation critical parts of enterprise mobile security programs.
Jul 12, 2026
Cybercriminals have increasingly targeted remote monitoring and management (RMM) tools to deploy malware and conduct large-scale cyberattacks. In 2025, attacks on RMM tools surged, with 51 different solutions identified as targets by security researchers. RMM tools, which became more prevalent during the COVID-19 pandemic to support remote work, are now being weaponized by threat actors due to their deep integration into enterprise IT environments. These tools, such as SuperOps and TeamViewer, are commonly used by IT professionals and managed service providers (MSPs) to remotely monitor, manage, and maintain client systems through centralized dashboards. Adversaries exploit these platforms by obtaining authenticated credentials, allowing them to bypass traditional security alerts and alarms. Once inside, attackers can disable scheduled backups, destroy system images and restore points, and push ransomware or other malicious payloads to thousands of endpoints simultaneously. The legitimate appearance of RMM tool traffic often allows malicious activity to evade anomaly detection systems, creating a persistent blind spot for network defenders. The elevated permissions typically granted to RMM platforms enable attackers to escalate privileges, move laterally within networks, and deliver malware efficiently. Compromising an MSP’s RMM infrastructure can have a supply chain effect, enabling attackers to pivot into multiple client environments and significantly amplifying the potential impact. This method of attack not only increases the blast radius but also enhances the monetization opportunities for cybercriminals. Security experts warn that the widespread use and trust in RMM tools make them an attractive and effective vector for cyberattacks. Organizations are urged to implement stronger authentication, monitor RMM tool usage closely, and restrict access to minimize risk. The trend highlights the need for enhanced vigilance and updated security controls around remote access and management solutions. The attacks demonstrate how tools designed for convenience and efficiency can become significant liabilities if not properly secured. The ongoing exploitation of RMM tools underscores the evolving tactics of cybercriminals in targeting trusted IT infrastructure. As attackers continue to refine their methods, defenders must adapt by prioritizing the security of remote management platforms. The surge in RMM tool exploitation serves as a stark reminder of the importance of supply chain security and the risks posed by third-party service providers. Organizations should review their incident response plans to ensure rapid detection and containment of attacks involving RMM platforms. The cybersecurity community continues to monitor this threat landscape, emphasizing the critical need for proactive defense measures.
Jun 29, 2026