Loading story…
Attackers used convincing lookalike websites impersonating CNN, Avast, and Stremio, along with fake crypto-mining game pages, to trick Windows users into installing O&O Syspectr, a legitimate, digitally signed remote administration tool. The installers were pre-linked to attacker-controlled Syspectr accounts, giving operators remote command execution, file access, software installation, and broader system control while reducing the chance of antivirus detection because the software itself was genuine. Researchers found the CNN-, Avast-, and Stremio-themed installers shared one embedded Syspectr account ID, while the crypto-themed lure used another, suggesting either multiple operators or separate accounts used by the same group.
The activity aligns with a broader phishing trend in which threat actors abuse legitimate remote monitoring and management tools instead of custom malware. In the SeasonalInvite campaign, active since at least January, attackers used nearly 1,000 domains, poisoned search results, and fake eCard pages to deliver signed tools including ConnectWise ScreenConnect, LogMeIn Resolve, Kaseya, and O&O Syspectr to Windows and macOS users. O&O Software GmbH said it suspended the abusive Syspectr accounts and disabled Remote Desktop and Remote Console for free Syspectr accounts, while researchers warned that the same traffic distribution infrastructure may be supporting multiple phishing operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
On July 14, Forescout published research describing the SeasonalInvite campaign, including its use of 959 domains, a traffic distribution system, and abused signed RMM products such as O&O Syspectr.
Forescout reported that the SeasonalInvite campaign was still delivering payloads in late June 2026, showing the operation remained active for at least six months.
Microsoft documented overlapping infrastructure in March 2026 when the same operation used tax-themed lures, linking SeasonalInvite to earlier activity.
Forescout said the SeasonalInvite phishing campaign had been active since at least January 2026, using fake electronic greeting card lures to trick Windows and macOS users into installing legitimate RMM tools.
Within days of learning about the abuse, O&O Software disabled Remote Desktop and Remote Console for free Syspectr accounts, identified and suspended the abusive accounts, and blocked them from adding new devices.
The same campaign also used fake crypto-mining lure sites, including syncminer[.]xyz and idleminer[.]pro, to distribute O&O Syspectr installers tied to a different embedded Syspectr account ID.
A campaign used lookalike CNN, Avast, and Stremio websites to trick Windows users into downloading legitimate O&O Syspectr installers pre-linked to an attacker-controlled account, enabling remote access if installed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemalwarebytes.com
Open sourceinfosecurity-magazine.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Forescout disclosed **SeasonalInvite**, a phishing campaign that uses fake seasonal eCard invitations to trick Windows and macOS users into installing legitimate remote monitoring and management (RMM) software, giving attackers persistent remote access without deploying traditional malware. Active since at least January 2026, the operation uses themed lures tied to events such as tax season, Valentine’s Day, and Easter, then routes victims through a traffic distribution system to counterfeit eCard pages that deliver installers tailored to the target operating system. Researchers said the attackers abused commercially signed tools including **ConnectWise ScreenConnect**, **LogMeIn Resolve**, **Kaseya**, and **O&O Syspectr**, helping the activity blend in with trusted software and evade standard trust checks. On macOS, the campaign reportedly paired a signed Kaseya package with a separate configuration file that redirected enrollment to attacker-controlled infrastructure through an unattended deployment feature. Forescout also identified a broad support infrastructure of **959** eCard-themed domains and **2,658** traffic distribution gate pages, along with evidence that parts of the phishing kit and web pages were likely AI-generated.
Jul 16, 2026
Threat researchers reported multiple phishing-driven intrusions in which attackers impersonate trusted brands and agencies to trick victims into installing legitimate remote monitoring and management (RMM) software for persistent access. In **Operation DoppelBrand**, financially motivated actor **GS7** spoofed Fortune 500 financial and technology brands (including **Wells Fargo** and **USAA**) using more than **150** lookalike domains to harvest credentials and exfiltrate data via attacker-controlled **Telegram bots**; researchers also identified nearly **200** additional domains with short registration terms, automated SSL, wildcard DNS, and brand-specific subdomains supporting the campaign. Separately, Forcepoint X-Labs described a wave of emails impersonating the **U.S. Social Security Administration** that delivers an attached `.cmd` script to weaken Windows defenses and enable silent installation of **ConnectWise ScreenConnect**. The script checks/elevates privileges, disables **Windows SmartScreen** via registry changes, removes **Mark-of-the-Web**, and uses **Alternate Data Streams (ADS)** for stealth before installing an MSI and configuring ScreenConnect (via `System.config`) to beacon to an attacker-controlled server (reported as `dof-connecttop` on port `8041`). Both activity sets highlight a recurring tradecraft pattern: **brand impersonation + scripted defense evasion + abuse of legitimate RMM tooling** (e.g., *LogMeIn Resolve*, *ScreenConnect*) to gain remote control and facilitate follow-on theft or persistence.
Jun 29, 2026
Sophos X-Ops reported that a phishing campaign tracked as **STAC6405** used invitation-themed lures to trick targets into installing legitimate remote monitoring and management tools, including **LogMeIn Resolve** and **ScreenConnect**, giving attackers unattended remote access. The activity was first observed in April 2025, peaked in October and November 2025, and affected more than 80 organizations, primarily in the United States. Sophos said some phishing links were still active at the time of reporting, indicating the campaign may still be ongoing. In most intrusions, the attackers stopped after establishing remote access, suggesting the operation may support initial access brokerage or maintain dormant persistence for later use. In two cases, however, the compromise advanced to second-stage activity: one intrusion deployed a **HeartCrypt**-packed infostealer that hid the mouse cursor, injected into `csc.exe`, contacted `45[.]56.162.138`, and stole browser, wallet, and system data; another used a ScreenConnect-based payload bundled with Java components and a likely **SimpleHelp**-related remote access binary to obtain interactive access before defenders contained the incident.
Jun 29, 2026