RMM Phishing Campaign

A massive phishing campaign is out there right now, and it's using a clever trick. Attackers are abusing legitimate remote monitoring and management software to get into people's systems. And they're covering their tracks by rotating their infrastructure every single day.

The operation spans 46 countries. The United States is the top target, accounting for 45% of the activity.

ANY.RUN researchers connected 601 cases to this campaign. The attackers use fake documents to trick victims into installing real RMM software. At first, it looked like this was mostly hitting Canada because they were using Canada Revenue Agency tax forms as bait. But it's way bigger than that.

Here's what's going on.

Quick Summary

The Lures

The attackers change their bait depending on who they're targeting. They're using:

• Shipping and UPS communications
• Adobe PDFs
• Tax notices
• US Social Security Administration themes
• Invoices
• Other documents

The goal is simple: get you to install legitimate RMM software. Once it's installed, they have remote access to your computer. They can see everything you do.

The Infrastructure Rotation

The attackers change their infrastructure constantly. Much faster than they change their attack methods.

The Numbers:

ANY.RUN found 425 kit URLs across 240 hosts. 94% of those URLs were only active for a single day. One day. That's it.

Where They Deploy Their Malware:

• Vercel
• GitHub Pages
• Netlify
• Compromised Websites

Where They Host Their Payloads:

• Amazon S3
• Cloudflare R2
• GitHub
• DigitalOcean Spaces
• Dropbox
• GoFile

Stable Indicators:

Although the infrastructure is constantly changing, the phishing kit still leaves some stable fingerprints:

• Assets that are shared (font1.woff2)
• Regularly used image resources
• Specific chain of delivery (secure.html → project/*.zip)

It was these stable patterns that helped to draw connections between various infrastructures.

Who's Being Targeted

The campaign hits a wide range of industries:

• Education
• Technology
• Government
• Banking and finance
• Manufacturing

Why This Campaign Is So Hard to Stop

Domains and RMM products are disposable. The attackers can spin up new ones in minutes. The delivery chain is more stable, but the individual pieces change constantly.

The Problem:

• Domains change daily
• RMM software is legitimate (so it doesn't look suspicious)
• Traditional detection misses the signs

The Solution:

Security teams need to look at the full picture. Not just individual alerts.

What Security Teams Should Do

1. Build a Product-Agnostic Defense

RMM software is legitimate. Attackers can switch between different vendors. Focus on the delivery chain and unauthorized remote access.

2. Look for Campaign Patterns

Don't just watch for domains. They change daily. Look for stable indicators like:

• font1.woff2 asset
• icons8-microsoft-word-94.png asset
• secure.html → project/*.zip chain

3. Be Aware of Password Protected ZIP Files

The attackers can use password-protected ZIP files to hide themselves.

4. Provide Context to Analysts

Use a tool that offers the whole picture – browser activity, scripts, processes, downloads, and networking.

What Organizations Should Do

1. Monitor for Unauthorized RMM Installations

RMM software is legitimate. But if the installation is done without permission, it’s a red flag.

2. Watch for Password-Protected Archives

Attackers love using password-protected ZIP files. It helps them bypass email filters.

3. Identify the Stable Indicators

Find out what stable indicators and delivery methods the hackers used in this attack.

4. Train Your Employees

Teach your employees about phishing attacks. Even if they look legitimate, they might not be.

The Bottom Line

A global RMM phishing campaign is using daily infrastructure rotation to stay ahead of detection. The United States is the highest-profile target. Attackers employ the use of fake documentation to get users to install legitimate RMM software.

What You Need to Know:

What You Need to Do:

• Check for RMM installation without authorization
• Watch out for password-protected archives
• Identify signs of a stable campaign
• Educate your employees about lures

FAQ Section

What is the RMM phishing campaign?

It's a global phishing campaign that tricks people into installing legitimate RMM software. Attackers use fake documents and rotate their infrastructure daily.

How many countries are affected?

The campaign spans 46 countries. 45% of activities are reported from the USA.

What is the rotation mechanism for the infrastructure?

94% of URLs are active for one day. The attackers use Vercel, GitHub Pages, Netlify, and hijacked sites.

Stable indicators would be?

The common files such as font1.woff2, common images, and secure.html to project/*.zip delivery model.

What is to be done by the security team?

Focus more on delivery models, stable indicators, and unauthorized remote access rather than only domains.

Source: The Hacker News