A 46-country phishing chain ends by installing the RMM tools allow lists already trust
Any.Run's researchers found a phishing kit running in 46 countries whose final payload is a signed copy of ScreenConnect or GoTo Resolve, which moves the defensive question from malware signatures to which remote-access tools may execute at all.
The Watch · Security desk
What happened
- Any.Run published research in late August on a phishing campaign against mainstream remote management and monitoring platforms running in 46 countries, with 45% of observed activity focused on the United States.
- The lures are ordinary tax notices, invoices, VAT notices and shipping mail, and the file they deliver is signed commercial remote-access software: GoTo Resolve, ScreenConnect, ConnectWise and LogMeIn.
- Delivery ran through Vercel, GitHub Pages, Netlify and compromised sites, with payloads staged on Amazon S3, Cloudflare R2, GitHub, DigitalOcean Spaces, Dropbox and GoFile.
- No credible source has named an actor, and Blackpoint Cyber says the signed payload leaves no malware family to fingerprint and no unique binary to reverse engineer.
Why it matters
- What it limits constraint The standard workflow of reversing a binary and publishing indicators produces nothing usable here, so the only durable control sits above the file: whether the tool is permitted to run in the estate at all.
- Who has to decide decision Someone has to name the sanctioned RMM vendors and management tenants and gate the rest, which means telling internal teams and clients that a support tool they currently use is now unapproved.
- Who's exposed exposure Any environment with an RMM on its allow list is reachable by whoever sends the invoice, and Culley says most have never tested whether an unexpected install of their own trusted tool raises anything.
- What it sets up precedent A kit that has already swapped through five RMM brands under one delivery layer means vendor-specific detections age out on the attacker's schedule, not the defender's release cycle.
Next story · Security · Sep 23
Fake Claude Max giveaway harvests Google logins through a window it draws itselfConfirmed2 publishers
The only anomalous event in the whole sequence is the last one. A staff member opens a document lure, pulls an installer from a cloud bucket, and a signed MSI stands up a remote-control service that hands the operator the same access an IT support technician would receive, in the description of Sectigo senior fellow Jason Soroko [8]. Nothing earlier in that chain trips a check, because signature and reputation checks wave the installer straight through, according to SafeBreach offensive security engineer Adrian Culley [12].
The infrastructure numbers explain why indicator feeds will not carry this one. Any.Run's researchers logged 425 kit URLs across 240 hosts, with 94% of that hosting observed for a single day only [7]. That works out to 1.8 URLs per host [17], and it leaves roughly 14 hosts with any life past the first day [18]. A blocklist built from that telemetry expires before it ships, which is why Soroko puts the weight on click-time link inspection and on a sequence rather than a product name: browser download, password-protected ZIP, VBS or PowerShell execution, MSI installation from cloud hosting, then a new remote-control service appearing [9].
The geography is lopsided. Forty-six countries, 45% of observed activity in the United States [1], which leaves 55% spread across the other 45 countries, an average near 1.2% each [19].
There are two readings of who is behind it, and both are offered as inference. Culley reads the URL and host discipline as a shared phishing-as-a-service kit rather than one operator's campaign [20]. Soroko reads the broad victim set, interchangeable lures and replaceable RMM products as more consistent with a criminal access business than focused espionage, and says plainly that this remains an inference [21]. Nobody has named an actor [13].
The control is an inventory problem. Soroko's line is to treat RMM enrollment like the creation of an administrator account: keep a list of approved products and approved management tenants, then block or require approval for everything else [10]. For a shop that already runs application control with one sanctioned RMM, that is a policy line item and some exception handling. For a managed service provider running several tools across client estates, it is the whole project, and Blackpoint Cyber threat operations director Jason Barnhizer says his team already sees RMMs used to install additional RMMs for layers of persistence [15]. Finding one unapproved agent therefore sets up the next question, which is what that agent installed after it landed.
What to watch
- Whether Any.Run or another vendor ties the kit to a named access broker, which would give responders something durable to track.
- Whether GoTo, ConnectWise and LogMeIn ship tenant-level enrollment controls or install telemetry that customers can query themselves.
- Whether the same delivery kit rotates to a sixth RMM product, which would support the phishing-as-a-service reading over a single crew.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+10
- Incentives70
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Research published in late August by Any.Run described a phishing campaign targeting mainstream remote management and monitoring (RMM) platforms operating in 46 countries, with 45% of observed activity focused on the United States.
- [2]
The campaign uses tax documents, Social Security notices, invoices, Adobe PDFs, VAT notices and shipping communications as lures to get victims to install legitimate RMM software.
- [3]
The payload at the end of the chain consists of legitimate, signed remote-management software rather than custom malware, according to SafeBreach offensive security engineer Adrian Culley.
- [4]
RMM products named in the campaign include GoTo Resolve, ScreenConnect, ConnectWise and LogMeIn, which Culley describes as business tools staff are meant to trust.
- [5]
The operation uses the Vercel web development platform, GitHub Pages, Netlify, compromised websites and other infrastructure for delivery.
- [6]
Payloads have also been staged through services including Amazon S3, Cloudflare R2, GitHub, DigitalOcean Spaces, Dropbox and GoFile.
- [7]
Researchers documented 425 kit URLs across 240 hosts, with 94% of the hosting infrastructure seen for a single day only.
- [8]
Sectigo senior fellow Jason Soroko says the attack works because it avoids a suspicious final payload: victims install signed remote-control software, giving the attacker the same access an IT support technician would receive.
- [9]
Soroko says teams should alert on any new remote-control service, especially after a browser download, password-protected ZIP, VBS or PowerShell execution, or MSI installation from cloud hosting, and should inspect links at click time because the infrastructure can vanish within a day; detection must follow the sequence of actions, not the product name.
- [10]
Soroko says enterprises should treat RMM enrollment like the creation of an administrator account, keeping an inventory of approved products and management tenants and then blocking or requiring approval for all others.
- [11]
The campaign has cycled through at least five different RMM vendors while keeping the same delivery kit underneath, making the product itself an interchangeable artifact.
- [12]
Culley says a signature or reputation check waves the installer straight through, and that the question is not whether EDR recognizes ScreenConnect but whether an unexpected install of it pulled from GitHub Pages or GoFile after a phishing click fires an alert, a path most environments have never tested because the tool is on every allow list.
- [13]
No credible source has named an actor behind the campaign.
- [14]
Blackpoint Cyber threat operations director Jason Barnhizer says RMM abuse as an initial access technique is one of the most common patterns his team deals with day to day in the SMB and MSP space, because the tools are already trusted and often already whitelisted in target environments.
- [15]
Barnhizer says his team sees cases where RMMs are used to install additional RMMs for layers of persistence.
- [16]
Barnhizer says RMM campaigns are hard to attribute because the legitimate signed payload leaves no malware family to fingerprint and no unique binary to reverse engineer, and because infrastructure gone within a day cannot support a durable actor profile.
- [17]
The documented kit averages about 1.8 URLs per host.
- [18]
If 94% of the 240 hosts were seen for a single day, roughly 14 hosts were observed for longer than one day.
- [19]
With 45% of observed activity in the United States, the remaining 55% averages about 1.2% per country across the other 45 countries.
- [20]
Culley says the documented infrastructure discipline reads like a shared phishing-as-a-service kit rather than one operator's campaign.
- [21]
Soroko says the broad victim set, interchangeable lures and replaceable RMM products are more consistent with a criminal access business than a focused espionage operation, though that still remains an inference.
Sources
2 independent publishers whose own reporting we read for this story.
- scworld.comPhishing campaign targets widely used RMM platforms in 46 countries
1 article · September 3, 2026
- thehackernews.comUS Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries
2 articles · September 3, 2026
Topics and entities
Topics
- Abuse of cloud hosting platforms
- Phishing
- Remote management tool abuse
- Phishing-as-a-service kits