Loading story…
Palo Alto Networks Unit 42 reported a phishing campaign that delivered the NetSupport Manager remote access trojan (RAT) to victim systems. The activity used malicious email lures to trick users into opening weaponized attachments or links, after which the attackers installed NetSupport Manager to gain remote control over infected hosts and establish persistent access.
The campaign highlighted how legitimate remote administration software can be repurposed for intrusion activity, allowing attackers to monitor systems, execute commands, and potentially move deeper into compromised environments. Unit 42 said Cortex XDR detected the operation, underscoring the continued risk posed by phishing-driven malware delivery and dual-use remote management tools in enterprise networks.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 published research on a newly observed phishing campaign that installs the NetSupport Manager remote access trojan. The report indicates Cortex XDR detected the activity and documents the campaign as an active threat development.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported multiple phishing-driven intrusions in which attackers impersonate trusted brands and agencies to trick victims into installing legitimate remote monitoring and management (RMM) software for persistent access. In **Operation DoppelBrand**, financially motivated actor **GS7** spoofed Fortune 500 financial and technology brands (including **Wells Fargo** and **USAA**) using more than **150** lookalike domains to harvest credentials and exfiltrate data via attacker-controlled **Telegram bots**; researchers also identified nearly **200** additional domains with short registration terms, automated SSL, wildcard DNS, and brand-specific subdomains supporting the campaign. Separately, Forcepoint X-Labs described a wave of emails impersonating the **U.S. Social Security Administration** that delivers an attached `.cmd` script to weaken Windows defenses and enable silent installation of **ConnectWise ScreenConnect**. The script checks/elevates privileges, disables **Windows SmartScreen** via registry changes, removes **Mark-of-the-Web**, and uses **Alternate Data Streams (ADS)** for stealth before installing an MSI and configuring ScreenConnect (via `System.config`) to beacon to an attacker-controlled server (reported as `dof-connecttop` on port `8041`). Both activity sets highlight a recurring tradecraft pattern: **brand impersonation + scripted defense evasion + abuse of legitimate RMM tooling** (e.g., *LogMeIn Resolve*, *ScreenConnect*) to gain remote control and facilitate follow-on theft or persistence.
Jun 29, 2026
Sophos X-Ops reported that a phishing campaign tracked as **STAC6405** used invitation-themed lures to trick targets into installing legitimate remote monitoring and management tools, including **LogMeIn Resolve** and **ScreenConnect**, giving attackers unattended remote access. The activity was first observed in April 2025, peaked in October and November 2025, and affected more than 80 organizations, primarily in the United States. Sophos said some phishing links were still active at the time of reporting, indicating the campaign may still be ongoing. In most intrusions, the attackers stopped after establishing remote access, suggesting the operation may support initial access brokerage or maintain dormant persistence for later use. In two cases, however, the compromise advanced to second-stage activity: one intrusion deployed a **HeartCrypt**-packed infostealer that hid the mouse cursor, injected into `csc.exe`, contacted `45[.]56.162.138`, and stole browser, wallet, and system data; another used a ScreenConnect-based payload bundled with Java components and a likely **SimpleHelp**-related remote access binary to obtain interactive access before defenders contained the incident.
Jun 29, 2026
Threat reporting has highlighted phishing-led intrusions in which attackers use legitimate remote monitoring and management (RMM) software to gain and retain access to victim environments. The approach can obscure malicious activity within approved administrative tooling, creating a material visibility gap for security teams and enabling adversaries to operate without deploying obviously malicious remote-access malware. The activity includes a U.S.-targeted phishing campaign and broader organized-cybercrime tradecraft that pair social engineering with RMM abuse. Organizations should treat unexpected RMM installation, new unattended-access configurations, and remote-control sessions initiated after phishing activity as high-priority signals; enforce application allowlisting and least privilege for RMM tools; and require strong authentication, centralized logging, and alerting for all remote-management access.
Sep 9, 2026