Cybersecurity researchers have identified a phishing campaign, dubbed Operation BlueDash, that leverages fake Microsoft Teams update notifications to distribute legitimate remote monitoring and management (RMM) tools, specifically Level RMM and ConnectWise ScreenConnect.
The attack begins with phishing emails that direct recipients to a counterfeit Microsoft Store page, hosted at “teamvem[.]com,” claiming that an update to Microsoft Teams is required to access a shared document. This deceptive page prompts users to download a file named “supportdev.exe.”
Upon execution, “supportdev.exe” utilizes Inno Setup to launch a hidden PowerShell window, which then downloads and installs the official Level RMM installer. The installation process includes an attacker-controlled enrollment secret, “LEVEL_API_KEY=GxSCHE8EZwfyYN3iPQHPai8D,” to register the compromised endpoint. Simultaneously, the same PowerShell command deploys ConnectWise ScreenConnect, indicating the attackers’ intent to establish multiple persistent remote access points.
Deploying multiple RMM tools on a single host enhances the attackers’ resilience, ensuring continued access even if one tool is detected and removed. Following the installation, the threat actors execute commands to assess the infected system’s state, including checking for pending reboots, evaluating system volume protection, identifying active firewall profiles, and enumerating members of the local Administrators group. This reconnaissance aids in determining the next steps for exploitation.
Further investigation into the attackers’ infrastructure revealed a GitHub Pages domain, “berry4603.github[.]io,” and a repository named “Bluedashltd,” containing the phishing source code, CNAME configuration, and the “SupportDev” payload. The commit history indicates that this campaign has been active since at least February 2026, with the repository initially created to host the fake Microsoft Store page featuring the fraudulent Teams update.
Additionally, a second repository, “rustovni,” associated with the same GitHub account, hosts a Zoom meeting lure and related payload-delivery components. In this variant, the attackers aim to download and install the Tactical RMM agent from its official GitHub release, registering the compromised host using an embedded authentication token. This suggests a broader, multi-brand phishing strategy targeting various communication platforms.
Operation BlueDash underscores the evolving tactics of cybercriminals who exploit trusted RMM tools to gain unauthorized access to systems. Organizations must remain vigilant against such sophisticated phishing schemes and implement robust security measures to detect and prevent unauthorized remote access.
