Loading story…
A Nigerian-linked threat actor ran at least 10 phishing campaigns from infrastructure associated with zoom4usinvite[.]space and a cPanel account at vistejet[.]com, impersonating brands including the U.S. Social Security Administration, Zoom, Adobe, Google, Microsoft, Xfinity, VistaJet, and Paperless Post. The operation used adversary-in-the-middle phishing kits to steal credentials, payment-card and Social Security numbers, and real-time MFA codes, with Telegram bots supporting immediate credential collection and session control. Researchers linked kit development artifacts to the handle @xforgex and cited Nigerian mobile-provider allowlisting and Lagos MTN development-log access as evidence of the operator's origin.
One SSA-themed email campaign used Information@allsecured[.]net and a shortened t[.]co URL to direct victims to a fake SSA download site at icci-sa[.]com, where they received ScreenConnect.ClientSetup.exe. The customized ScreenConnect installer communicated with 15.204.43[.]235 over TCP/443 using encrypted ScreenConnect traffic, providing the operator potential remote-access backdoor capability. The broader infrastructure also distributed ScreenConnect and FleetDeck remote-management agents through BAT, HTA, MSI, and EXE payloads, combining financial-data theft and account takeover with persistent endpoint access.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Overview Matrix flagged zoom4usinvite[.]space as a Zoom-themed phishing site. Analysis of its open directory and a publicly readable 42 MB backup archive exposed additional phishing kits; related vistejet[.]com infrastructure expanded the observed operation to at least ten campaigns and was assessed as controlled by the same Nigerian-origin actor.
A phishing email impersonating the U.S. Social Security Administration used a t.co link to a fake SSA-themed site at icci-sa[.]com, where victims could download ScreenConnect.ClientSetup.exe. The customized installer subsequently communicated with 15.204.43[.]235 over encrypted TCP/443 ScreenConnect traffic.
Development logs on the actor-controlled infrastructure recorded 57 accesses from Lagos, Nigeria MTN egress ranges. The report treats these records, together with Nigerian mobile-provider allowlisting, as evidence of a Nigerian-origin operator.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 54 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
carlesi.vg
Open sourcemalware-traffic-analysis.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SOCRadar linked hundreds of phishing campaigns impersonating the **IRS**, **Social Security Administration**, **DocuSign**, and other trusted brands to a phishing-as-a-service operation known as **The Quarry**. The service, attributed to a developer using the aliases **RockyBelling**, **Rock**, **Rockky**, and **Mike**, has been active since at least April 2025 and supports nearly 200 affiliates. Researchers identified more than 80 domains, over 40 **ConnectWise ScreenConnect** panels, and more than 500 victim IPs across 14 countries, with over 90% of observed victims located in the United States. Rather than relying primarily on conventional malware, the operation used legitimate remote monitoring and management software—especially **ScreenConnect**—to gain remote access while evading detection. The toolkit used layered filtering, Adspect-based cloaking, bulk email tooling, Telegram-based coordination and exfiltration, and in April 2026 added a **VBS** dropper with **UAC bypass** that fetched ScreenConnect installers and decoy PDFs from GitHub or GitLab. Post-compromise activity included browser history collection, **W-2** harvesting, credential and cookie theft via **VioletRAT**, and suspected monetization through financial fraud, tax-related identity theft, initial access brokerage, and possible resale of access to ransomware operators.
Jun 29, 2026
Threat researchers reported multiple phishing-driven intrusions in which attackers impersonate trusted brands and agencies to trick victims into installing legitimate remote monitoring and management (RMM) software for persistent access. In **Operation DoppelBrand**, financially motivated actor **GS7** spoofed Fortune 500 financial and technology brands (including **Wells Fargo** and **USAA**) using more than **150** lookalike domains to harvest credentials and exfiltrate data via attacker-controlled **Telegram bots**; researchers also identified nearly **200** additional domains with short registration terms, automated SSL, wildcard DNS, and brand-specific subdomains supporting the campaign. Separately, Forcepoint X-Labs described a wave of emails impersonating the **U.S. Social Security Administration** that delivers an attached `.cmd` script to weaken Windows defenses and enable silent installation of **ConnectWise ScreenConnect**. The script checks/elevates privileges, disables **Windows SmartScreen** via registry changes, removes **Mark-of-the-Web**, and uses **Alternate Data Streams (ADS)** for stealth before installing an MSI and configuring ScreenConnect (via `System.config`) to beacon to an attacker-controlled server (reported as `dof-connecttop` on port `8041`). Both activity sets highlight a recurring tradecraft pattern: **brand impersonation + scripted defense evasion + abuse of legitimate RMM tooling** (e.g., *LogMeIn Resolve*, *ScreenConnect*) to gain remote control and facilitate follow-on theft or persistence.
Jun 29, 2026
A phishing campaign tracked as **VENOMOUS#HELPER** has compromised more than 80 organizations since at least April 2025, primarily in the United States, with additional victims in Western Europe and Latin America. Attackers used emails impersonating the U.S. Social Security Administration to drive targets to fake SSA pages hosted via compromised legitimate websites, including a Mexican domain used to help evade filtering. Victims who downloaded the fake SSA statement executable installed vendor-signed remote monitoring and management tools instead of conventional malware, giving the operators covert access through **SimpleHelp** and **ConnectWise ScreenConnect**. Researchers said the malware chain deployed a self-hosted **SimpleHelp 5.0.1** instance packaged with JWrapper and a separate ScreenConnect relay, creating redundant remote access if one channel was blocked. The installed tooling persisted as a Windows service, survived Safe Mode, polled for Wi-Fi status, firewall state, security products, user activity, and mouse movement, and in some cases renamed `wmic.exe` to evade name-based detections. Separate infrastructure analysis linked a signed SimpleHelp client to a five-server command-and-control cluster on `147.45.218.0/24`, a Russian-language portal at `dangerstock[.]online`, and an exposed Cockpit dashboard, with Fortinet tracking the infrastructure as **PALLASNET.M**; Securonix assessed the broader activity as consistent with a financially motivated initial access broker or ransomware precursor.
Jun 29, 2026