A global phishing campaign has been observed using legitimate remote monitoring and management tools—widely used for IT support—to take control of victim systems. The attackers trick people into installing signed, trusted software so their activity blends into usual admin operations instead of triggering malware alerts.
Campaign Overview and Tactics
The operation kicks off with email lures styled as official documents—fake Canada Revenue Agency tax forms, Social Security Administration notices, PDF prompts from Adobe, invoices, VAT alerts, shipping messages, or shared file updates. These reach targets in 46 countries, with almost half of the activity observed in the United States.
The emails lead to a short-lived site hosted on trusted cloud platforms or compromised websites where recipients are presented with an access code and invited to download a password-protected ZIP file. Because ZIP archives are harder for email filters to scan, once extracted, a Visual Basic script activates a PowerShell script that downloads and installs an RMM tool. Tools observed include GoTo Resolve, LogMeIn Rescue, ScreenConnect, ConnectWise, and ITarian.
Infrastructure, Obfuscation, and Indicators
This campaign has run since January 2026. In just under six months, thousands of phishing kit URLs were identified—over 425 across 240 hosts—with a striking 94% of hosts existing for only a single day. In particular, one-use Vercel applications feature heavily in the malicious delivery system, allowing for frequent domain churn that complicates detection.
To avoid automated analysis, the attackers include delays, content gate pages with browser/location fingerprinting, optional challenges like hCaptcha, and harmless PDF content to distract victims. When downloaded, the final payload—an RMM installer—gives remote access privileges, allowing attackers to navigate systems, execute commands, or escalate further inside the network.
Defensive Advice for Enterprises
Blocking one RMM tool or a particular domain won’t reliably block this campaign due to constant changes in domain names and delivery infrastructure. Organizations are encouraged to flag unexpected installations of remote-access tools—especially when they stem from password-protected archives, new hosting platforms, or user-triggered scripts.
Maintaining a whitelist of approved remote-access products can help detect unauthorized RMM software. Also important are email training for employees, clear protocols for verifying invoices, tax forms, or other official documents, and monitoring PowerShell activity that leads to MSI downloads. Analysts should look for repeated elements in the phishing chain—kit delivery flows and page-to-archive transitions—rather than depending solely on domain reputation.
This operation appears to target a wide range of industries—education, government, banking, manufacturing, finance, and technology are among those most affected.
Indicators of compromise (IoCs) include specific URL patterns (such as “*/secure.html” on subdomains of vercel.app), password-protected ZIP files hosted on these domains, recognizable font or image file references, and domain names crafted to mimic tax or confirmation services.
While this campaign is already extensive, researchers warn that observed incidents likely represent only a portion of total activity. Its use of legitimate remote-access tools and domain tricks means many attacks could go undetected until the RMM software is leveraged deep in enterprise networks.
In practice, every new or unexpected instance of RMM software should raise red flags. The true risk lies in stealth—this campaign doesn’t rely on classic malware signatures, but on abusing trusted infrastructure and tools.
This means defenders must adapt, focusing not just on known threat indicators, but on unusual behaviors: strange download paths, odd domain names, and processes triggered from power users or unfamiliar sources. It underscores how attackers are increasingly leveraging what looks safe to bypass security, turning ordinary remote-support tools into vectors for serious compromise.
Closing Analysis:
This campaign marks a shift in phishing strategies—moving from fake malware to abusing trusted remote-access tools that evade typical defenses. The deception is in the details: signed software, legitimate host platforms, cryptic domain names. Going forward, the security community needs to adjust: detection must focus on behavior, not just tools or signatures. Monitoring host setup, enforcing software approval policies, and investing in user training are no longer optional—they’re vital to keep these invisible attacks from gaining a foothold.
