Fake eCards Trick Users Into Installing RMM

How the Attack Worked

This campaign ran for roughly six months, using rotating seasonal lures such as tax and Social Security themes, Valentine's Day, Easter, and spring invitations to keep the pretext fresh. Victims who clicked a link were screened by a traffic distribution system before landing on a page impersonating greeting card service BlueMountain. After a short loading animation, the page automatically downloaded an installer tailored to the visitor's operating system, Windows or macOS.

On Windows, batch and VBScript droppers fetched the installer and relaunched themselves in a way that triggered a User Account Control prompt, so the victim had to actively approve the privileged install. On macOS, a signed package was paired with a separate configuration file that redirected enrollment to the attacker's server using an unattended-deployment feature. In both cases, the underlying software installed was a legitimate, commercially signed remote monitoring and management tool, including products from ConnectWise, LogMeIn, Kaseya, and O&O.

Why It Succeeded

The campaign's strength was combining a familiar, low-suspicion pretext, an electronic greeting card, with software that is genuinely legitimate and signed. Because the RMM tools themselves are not malware, they were harder for typical security controls to flag. The rotating seasonal themes also let attackers keep the lure relevant throughout the year, and 959 domains were identified in phishing emails and poisoned search results, giving the operation broad reach and resilience against blocklisting.

What to Watch For

• A greeting card or invitation page that automatically starts a software download
• An unexpected request to install remote support or management software
• A Windows elevation (UAC) prompt appearing during what should be a simple card-viewing activity
• Search results or links that redirect through multiple pages before a download begins
• Seasonal or calendar-themed subject lines (tax, holidays, invitations) tied to an unusual software install

Building Resistance

Organizations should train staff to treat any eCard or invitation that triggers a software download as suspicious and to report it rather than proceed. Employees should also be taught to stop and verify through a known IT channel whenever an elevation prompt appears that doesn't match a business task. On the technical side, maintaining an approved inventory of RMM tools and alerting on any unexpected or unapproved RMM installation, even when validly signed, closes the gap that legitimate software abuse otherwise creates. Hardening email and web filtering against seasonal-themed lures rounds out the defense, since this campaign's core trick was matching its pretext to whatever time of year it launched.

How did the fake eCard phishing campaign work?

Victims were funneled through a traffic distribution system to a page impersonating greeting card service BlueMountain, which auto-downloaded an OS-specific installer for legitimate remote monitoring and management software.

Why were these installs hard to detect?

The campaign abused commercially signed RMM tools like ConnectWise ScreenConnect, LogMeIn Resolve, Kaseya, and O&O Syspectr, which are legitimate software and harder for typical defenses to flag as malware.

What should employees watch for with this type of attack?

Any eCard or invitation that triggers a software download should be treated as suspicious, especially if it prompts a Windows UAC elevation approval or a macOS install unrelated to a business task.

How can organizations defend against RMM-based phishing?

Maintain an approved inventory of remote-management tools, alert on any unexpected RMM installs even if validly signed, and harden email and web filtering against seasonal-themed lures.