As reported by The Hacker News, a sprawling remote monitoring and management (RMM) phishing operation spanning 46 countries has placed the United States squarely in the crosshairs, accounting for roughly 45% of observed activity. What initially appeared to be a Canada-focused tax fraud campaign has revealed itself as a globally adaptive operation with 601 connected cases and infrastructure that rotates on a near-daily basis.

Threat Alert: The core problem here isn't novel — threat actors have been abusing legitimate RMM tools like ScreenConnect, AnyDesk, and TeamViewer for years to establish persistence and blend into normal administrative traffic.

The core problem here isn't novel — threat actors have been abusing legitimate RMM tools like ScreenConnect, AnyDesk, and TeamViewer for years to establish persistence and blend into normal administrative traffic. What makes this campaign noteworthy is the operational discipline behind its delivery layer and the sheer scale of its infrastructure rotation, which collectively render traditional IOC-based defenses nearly irrelevant.

Why This Campaign Evades Traditional Defenses

ANY.RUN's research identifies 425 kit URLs spread across 240 hosts, with 94% of infrastructure observed for only a single day. This is a deliberate design choice. By leveraging legitimate serverless and static-hosting platforms — Vercel, GitHub Pages, Netlify — alongside cloud storage services like S3, Cloudflare R2, and DigitalOcean Spaces, the operators ensure that any domain-based blocklist or URL reputation system is perpetually chasing yesterday's infrastructure.

The more troubling reality is that the RMM software itself is legitimate. When an attacker installs a licensed RMM agent on a victim's machine, endpoint detection and response (EDR) tools face a difficult decision: flag a known-good application and risk alert fatigue, or allow it and miss the initial access vector entirely. This is the classic living-off-the-land (LotL) dilemma, and this campaign exploits it effectively.

The phishing kit's stable fingerprints — shared assets like font1.woff2, recurring image resources, and the secure.html → project/*.zip delivery chain — are the operational seams that defenders must exploit.

Who Is Most at Risk

The targeting profile spans education, technology, government, banking, finance, and manufacturing. However, the organizations most exposed are those with:

  • Permissive email filtering that allows cloud-hosted URLs from Vercel, Netlify, and GitHub Pages without additional scrutiny
  • Lack of application allow-listing or control over RMM tool installation on endpoints
  • Insufficient monitoring of outbound remote-access sessions, particularly to unfamiliar RMM infrastructure
  • Help desk or finance teams who are the likely recipients of tax-themed, shipping, and invoice lures

The Broader Implication: Detection Must Evolve Beyond Reputation

This campaign is a case study in why detection strategies built on malware verdicts, file reputation, and individual IOCs are structurally insufficient against modern social engineering operations. The payloads are legitimate software. The infrastructure is disposable. The lures rotate to match regional context. Defenders who continue to anchor on point-in-time reputation will consistently arrive one day late.

The path forward requires detecting the pattern, not the instance. Shared kit assets, delivery-chain structure, and unauthorized remote-access behavior are far more stable than the domains and individual RMM products being cycled through. Security teams that build detection logic around these stable elements will weather infrastructure rotation far better than those chasing URLs.

Shield53 Recommendations

Immediate Actions

Shield53 Recommendations
Block or sandbox links from serverless hosting platforms — Vercel, Netlify, and GitHub Pages URLs arriving via email from external senders should be treated as high-risk and subjected to URL detonation before delivery.
Deploy RMM installation controls — Use application control policies (WDAC, AppLocker, or equivalent) to prevent unauthorized installation of RMM agents. Maintain an approved RMM tool inventory and alert on any deviation.
Hunt for the stable kit indicators — Search web proxy and email gateway logs for the delivery pattern secure.html resolving to project/*.zip downloads, and for shared assets like font1.woff2 and icons8-microsoft-word-94.png referenced in suspicious landing pages.
Monitor outbound RMM sessions — Alert on new outbound connections to RMM tool command-and-control infrastructure from endpoints that have no documented history of using that software. Correlate with help desk ticketing to verify legitimacy.
Enhance email gateway rules for tax-themed, shipping, and invoice lures — particularly those containing links rather than attachments — targeting finance, HR, and administrative staff.

Strategic Posture

  • Transition detection logic from IOC-centric to behavior-centric analysis, focusing on unauthorized software installation, anomalous remote-access establishment, and delivery-chain patterns.
  • Engage with threat intelligence feeds that track phishing kit infrastructure and shared assets, not just malware hashes and domains.
  • Conduct tabletop exercises simulating RMM-based initial access, ensuring IR playbooks cover legitimate-tool abuse scenarios with the same rigor as malware-based intrusions.