phishing campaign uses RMM installers for remote access; 601 incidents in 46 countries

A phishing campaign that uses legitimate remote monitoring and management software (RMM) installers to get unauthorized remote access has turned out to be much wider than it initially seemed. Researchers from ANY.RUN linked 601 incidents to this operation, which uses false documents as decoy - from Canadian tax forms to shipping notices, bills or US Social Security notifications - and has been detected in 46 countries with approximately 45% of traffic from the United States. The findings show a fast and disposable delivery pattern that complicates detection based on simple lock lists.

Technically, the deception follows a repeatable chain: mail with fraudulent file or link → phishing page hosted in ephemeral infrastructures → download from a compressed package or installer that installs or instructs the installation of legitimate RMM software. ANY.RUN documented 425 URLs of phishing kits distributed in 240 different hosts; 94% of these hosts were active only one day, which indicates a massive rotation of infrastructure. The attackers use deployment platforms that allow you to create public sites quickly - Vercel, GitHub Pages, Netify - and also house charges in storage services such as Amazon S3, Cloudflare R2, GitHub, DigitalOcean Spaces, Dropbox and GoFile.

Although domains and accommodation change constantly, researchers managed to group multiple incidents thanks to persistent prints on the phishing kit: shared resources such as the font1.woff2 source file, a recurring icons8-microsoft-word-94.png image and the secure delivery structure (sequre.html which refers project / * .zip). These pieces act as more stable indicators within a topology designed to disappear within a few days.

Why does this method work? Because it combines social engineering with the abuse of legitimate software. When the victim runs or installs an RMM client - often in a file within a password-protected ZIP for mocking mail filters - the attacker gets a remote connection that usually allows to climb privileges, move laterally into corporate networks and exfilter data. The risk is not just the loss of information: remote access is a regular gateway to deploying ansomware, financial fraud and long-term commitments to IT environments.

The most frequently observed sectors include education, technology and public administration, with a significant presence of banking, finance and manufacturing. These observations confirm that adversaries prioritize sectors with sensitive data combinations, payment capabilities and operational units in remote systems.

Confirmed facts: ANY.RUN reported 601 cases connected to the operation, activity in 46 countries, ~ 45% of the traffic linked to the United States, 425 URLs of kits in 240 hosts and 94% of the hosts observed for one day. The rotation of infrastructure (Vercel, GitHub Pages, Netlify, etc.) and the use of storage services for payloads are also confirmed. Estimates and uncertainties: there are no verified public data on the total number of victims affected, or on the responsible actor or groups; neither is the operational success (rate of actual facilities) quantified and the proportion of intrusions that resulted in major incidents such as ansomware.

The practical implications for organizations and end-users are clear: lost control over stations and servers, possible exfiltration and use of remote access for subsequent attacks. In addition, the rotation strategy makes containment difficult by static IOCs alone, because the domains and hosts disappear before the lock lists are updated.

Specific and operational recommendations for security equipment and technical readers:

1) Prioritize detection in the delivery chain and behavior, not only in domains. Find repeated patterns such as sequre.html → project / * .zip sequence, common static resources (e.g. font1.woff2, icons8-microsoft-word-94.png) and compressed file downloads from ephemeral deployment platforms. Create SIEM / EDR rules that correlate downloads of ZIPs from GitHub Pages, Vercel, Netlify or other public hosts with subsequent execution of RMM installers.

2) Strengthen controls on the mail layer. Block or mark for review the password-protected attachments from external transmitters; require additional verification (e.g. contact outside the mail chain) before allowing for opening. Implement policies that restrict the automatic execution of downloaded content and disable the silent removal of files from post.

3) Apply zero trust and endpoints hardening principles. Restrict software installation to approved lists; use privilege lifting controls and application whitelisting. Monitor processes that establish unusual outgoing connections and link them to RMM processes or recent installations. Record and alert about parent-child process chains where browsers download executables and launch unknown binaries.

4) Enable context-based detection and response. Interactive sandboxes that show browser activity, scripts, downloads and connections (such as those used by ANY.RUN) help distinguish between legitimate use and abuse. Enriching alerts with Threat Intelligence data to correlate persistent kits with new disposable domains.

5) Practical awareness for end-users. Do not run remote access software or open compressed files of unverified transmitters; check legitimacy through alternative channels (call official number, corporate portal). For integrators and administrators, limit RMM access to maintenance windows and apply multifactor records and authentication to remote sessions.

These recommendations should be implemented product-agnostic: the report shows that attackers exchange tools and suppliers, so depending on blockages per seller leaves gaps. To better understand the remote access technique and its classification in threat frames, the MITRE ATT & CK base on remote access software ( https: / / attack.mitre.org / techniques / T1219 /). For an interactive analysis of the campaign and the grouped indicators, see the ANY.RUN platform ( https: / / any.run /).

In short, the most worrying element of this campaign is not the novelty of tools, but the combination of social engineering with disposable infrastructure and legitimate services such as delivery channels. To defend yourself effectively, it is necessary to change the focus: from static IOCs to detection of abnormal delivery chains and behavior associated with the use of MMR, and to operationalize contextual intelligence that allows SOC teams to distinguish between legitimate administration and abuse.