Loading story…
A phishing campaign active since January 2026 has targeted victims in 46 countries—45% of observed activity involved the United States—using tax forms, Social Security notices, invoices, VAT, shipping, Adobe PDF, and shared-file lures. Victims are sent to short-lived pages hosted on services including Vercel, Netlify, Amazon S3, and DigitalOcean Spaces, or on compromised sites, then prompted to download password-protected ZIP archives. The archives use a VBS-to-PowerShell chain to retrieve signed installers for legitimate remote monitoring and management (RMM) products, giving operators interactive access without relying on conventional malware.
The operators rotate among GoTo Resolve, LogMeIn Rescue, ScreenConnect, ConnectWise, and ITarian, limiting the value of product-specific blocking. Researchers identified 425 delivery-kit URLs across 240 hosts between February 5 and July 29, with 94% of hosts remaining live for only one day; stable kit artifacts included fmtt font files, font1.woff2, icons8-microsoft-word-94.png, and a secure.html-to-ZIP delivery chain. Organizations should detect and investigate unauthorized RMM deployments, particularly script-initiated PowerShell downloads of MSI installers, newly installed support software, and password-protected ZIP files delivered through phishing pages.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Between February 5 and July 29, researchers recorded 425 phishing-kit URLs across 240 hosts supporting the campaign. The infrastructure included one-use Vercel applications, compromised sites, cloud-hosting services, and dynamic-DNS hosts; 94% of observed hosts were active for only one day.
A phishing campaign began abusing legitimate remote monitoring and management software to obtain interactive remote access to victim systems. It used fake tax documents, Social Security notices, invoices, shipping messages, and other document-themed lures.
An open Apache directory on pluks.org exposed phishing kits, archives, and operator tooling used to steal credentials through Telegram-backed workflows, including an AiTM kit with an interactive victim-session console. The exposed artifacts also showed delivery of ConnectWise ScreenConnect and Faronics Deploy Agent via document-themed lures, gated victim-specific downloads, and related domains and Telegram accounts.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 64 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
carlesi.vg
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourceany.run
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported multiple phishing-driven intrusions in which attackers impersonate trusted brands and agencies to trick victims into installing legitimate remote monitoring and management (RMM) software for persistent access. In **Operation DoppelBrand**, financially motivated actor **GS7** spoofed Fortune 500 financial and technology brands (including **Wells Fargo** and **USAA**) using more than **150** lookalike domains to harvest credentials and exfiltrate data via attacker-controlled **Telegram bots**; researchers also identified nearly **200** additional domains with short registration terms, automated SSL, wildcard DNS, and brand-specific subdomains supporting the campaign. Separately, Forcepoint X-Labs described a wave of emails impersonating the **U.S. Social Security Administration** that delivers an attached `.cmd` script to weaken Windows defenses and enable silent installation of **ConnectWise ScreenConnect**. The script checks/elevates privileges, disables **Windows SmartScreen** via registry changes, removes **Mark-of-the-Web**, and uses **Alternate Data Streams (ADS)** for stealth before installing an MSI and configuring ScreenConnect (via `System.config`) to beacon to an attacker-controlled server (reported as `dof-connecttop` on port `8041`). Both activity sets highlight a recurring tradecraft pattern: **brand impersonation + scripted defense evasion + abuse of legitimate RMM tooling** (e.g., *LogMeIn Resolve*, *ScreenConnect*) to gain remote control and facilitate follow-on theft or persistence.
Jun 29, 2026
Threat reporting has highlighted phishing-led intrusions in which attackers use legitimate remote monitoring and management (RMM) software to gain and retain access to victim environments. The approach can obscure malicious activity within approved administrative tooling, creating a material visibility gap for security teams and enabling adversaries to operate without deploying obviously malicious remote-access malware. The activity includes a U.S.-targeted phishing campaign and broader organized-cybercrime tradecraft that pair social engineering with RMM abuse. Organizations should treat unexpected RMM installation, new unattended-access configurations, and remote-control sessions initiated after phishing activity as high-priority signals; enforce application allowlisting and least privilege for RMM tools; and require strong authentication, centralized logging, and alerting for all remote-management access.
Sep 9, 2026
Threat actors have been observed using spearphishing lures and *non-traditional* attachment types—particularly Windows screensaver (`.scr`) executables—to trick users into running code that silently installs legitimate **remote monitoring and management (RMM)** agents (e.g., **SimpleHelp**). ReliaQuest research described business-themed filenames (e.g., `InvoiceDetails.scr`, `ProjectSummary.scr`) delivered via links hosted on legitimate cloud services (e.g., GoFile), with the `.scr` format helping bypass controls that don’t treat screensavers as executables. Once installed, the RMM tooling provides interactive remote access that can enable data theft, lateral movement, and follow-on payload deployment, including ransomware, while blending into normal IT administration traffic. Separately, researchers also reported a spam operation using **fake PDF attachments** that display an error message and redirect victims to a lookalike *Adobe Acrobat* download flow, but instead installs trusted, digitally signed RMM software to establish persistent access. A different phishing campaign used a multi-stage **PDF chain** hosted on reputable infrastructure (e.g., **Vercel Blob**) to redirect victims to a credential-harvesting page and exfiltrate stolen data via a **Telegram bot**, emphasizing how attackers are increasingly abusing high-reputation cloud platforms and document-based lures to evade email and web filtering (including scenarios where the initial email contains no malicious link and can pass SPF/DKIM/DMARC checks).
Jun 29, 2026