Researchers reported a real phishing operation spanning 46 countries that tricks people into installing legitimate remote monitoring and management (RMM) tools, giving attackers remote access that can look like normal IT activity. The lures use familiar business themes (tax documents, invoices, shipping notices, DocuSign) and sometimes arrive as password-protected ZIP files that run scripts to download the RMM software.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “Tax Document, Action Required (Password-Protected ZIP).” Looks official, right? In a real campaign across 46 countries, that ZIP hid a VBS script that fired up PowerShell and quietly installed legit remote monitoring tools, exactly what IT uses, but now under someone else’s control. The lure looks boringly normal: fake tax notices, invoices, shipping updates, even DocuSign. The giveaway isn’t the logo, it’s the ask: a password-protected ZIP and a script you have to run just to “view” a document. If you ever see a tax, invoice, shipping, or DocuSign email that wants you to open a password-protected ZIP or run anything, stop and forward it to Security, do not open the ZIP.
Researchers described an active phishing campaign that tricks people with fake Adobe/Zoom update and “document review” themes to install the legitimate ScreenConnect remote-access tool. Once installed, attackers get persistent remote control of the victim’s computer while blending in as normal IT…
Researchers observed a real phishing campaign (“CSuite”) heavily targeting U.S. organizations using familiar business-themed lures (DocuSign, Adobe, Zoom/Meet, Dropbox, Microsoft 365). After a victim engages, the attackers either steal Microsoft 365 sessions (enabling mailbox takeover and fraud) or…
Microsoft reported real phishing campaigns that trick users into running a legitimate MSP360 remote-management installer disguised as meeting invites, PDFs, and software updates. After MSP360 is installed, attackers use it to silently install ScreenConnect as a second remote-access path, then use…
Cofense reports multiple real-world campaigns where attackers don’t hack the browser, they trick employees by copying normal browser experiences like login pop-ups, software update prompts, and “verification” checks. The goal is to get users to enter credentials, approve attacker sessions, or run…
Researchers reported a real TA488 campaign where a specially crafted email exploits an Outlook Web Access (OWA) flaw and runs malicious JavaScript as soon as the user opens the message. The attack relies on normal-looking business topics to get people to quickly view the email, and then uses…
Microsoft reports real-world Star Blizzard phishing campaigns where victims who engage with an initial email receive a follow-up message containing a password-protected ZIP/RAR attachment. The attachment chain hides a malicious shortcut disguised as a PDF, opening a decoy file while quietly…
