Attackers have found a quieter way in: instead of dropping obvious malware, they get the victim to install a real, signed remote-management tool. A phishing operation tracked by ANY.RUN now spans 46 countries, and the United States has moved to the top of the list at 45% of observed activity, with 601 cases tied to the same effort. The payload is not exotic. It is legitimate remote monitoring and management (RMM) software, the same category of tool your own IT team uses to administer machines remotely (per The Hacker News).
What happened
The lures are tailored by region and by what the recipient expects to see. Researchers observed Canada Revenue Agency tax forms, UPS and other shipping notices, Adobe PDF prompts, US Social Security Administration themes, and plain invoices. Each one nudges the user toward a download that installs an RMM agent rather than a document viewer. The campaign is vendor-agnostic. No single product is the story, because the operators swap tools freely.
The targeting is broad but not random. Education, technology, government, banking and finance, and manufacturing all show up in the data. Those are sectors with large user bases, frequent legitimate remote-support activity, and staff who are used to installing IT tools when asked. That last habit is exactly what the campaign leans on.
How the delivery chain works
The infrastructure is deliberately disposable. Researchers counted 425 phishing kit URLs spread across 240 hosts, and 94% of those URLs were seen for only a single day. The hosting is scattered across services most defenders will not want to block wholesale: Vercel, GitHub Pages, Netlify, Amazon S3, Cloudflare R2, DigitalOcean Spaces, Dropbox and GoFile, plus compromised legitimate sites. Rotating that fast defeats simple domain and URL blocklists.
What does not rotate is the plumbing underneath. The kits share stable fingerprints across the churn: a common web font (font1.woff2), recurring image assets such as icons8-microsoft-word-94.png, and a consistent delivery structure that runs from a secure.html landing page to a project/*.zip download. The archives are password-protected, which is not a courtesy to the victim. A password on the zip means most mail gateways cannot open and scan the contents, so the payload slides past filters that would otherwise flag it.
The researchers put the lesson plainly: “Individual domains and RMM products are disposable, while the underlying delivery chain is more stable.” In other words, chasing the domain of the week or banning a particular RMM brand is a losing game. The pattern is the signal.
Why this matters for Cyprus organisations
Legitimate RMM tools are signed, often allow-listed, and frequently already present somewhere in the estate for real support work. That makes abuse hard to spot: the process is not malware in the classic sense, and an antivirus verdict alone will not save you. For Cyprus businesses that outsource IT support or run lean internal teams, the risk is sharper still, because staff are conditioned to accept a remote-access request from “support” without much friction.
An attacker with a working RMM session has hands-on-keyboard access. From there they can move laterally, stage data, or hand off to a ransomware crew. The install looks like a helpdesk action, and the traffic looks like normal management traffic. That is the whole point of the technique.
What to do
Defence here is about the delivery chain and the behaviour, not the brand. Practical steps:
- Handle password-protected archives at the mail layer. Quarantine, detonate, or hold zips whose passwords arrive in the same message, rather than passing them straight to inboxes.
- Alert on unauthorised remote-access activity. Watch for RMM agents installed outside your approved list, or approved tools launching from a user’s Downloads folder or a browser session.
- Use behavioural and sandbox analysis instead of relying on file reputation. A signed installer that beacons to an unfamiliar host is the tell.
- Maintain an inventory of the RMM tools you actually sanction, so anything else stands out by exception.
Controls only go so far when the last step is a person clicking install. This campaign works because users approve the tool themselves, so the honest question is how your people respond under a realistic lure. A controlled phishing simulation measures that directly: who downloads the archive, who runs the installer, who approves the remote session, and whether your monitoring catches the RMM agent before it does anything useful. It turns an assumption about awareness into a number you can act on.
The bottom line
This is social engineering wearing an IT-support badge. The domains and the specific RMM products will keep changing; the lure-to-archive-to-remote-access pattern will not. Defend the chain, watch for remote-access activity you did not authorise, and test whether your users and your monitoring hold up when the request looks routine.