Researchers reported a real phishing operation spanning 46 countries that tricks people into installing legitimate remote monitoring and management (RMM) tools, giving attackers remote access that can look like normal IT activity. The lures use familiar business themes (tax documents, invoices, shipping notices, DocuSign) and sometimes arrive as password-protected ZIP files that run scripts to download the RMM software.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “Tax Document, Action Required (Password-Protected ZIP).” Looks official, right? In a real campaign across 46 countries, that ZIP hid a VBS script that fired up PowerShell and quietly installed legit remote monitoring tools, exactly what IT uses, but now under someone else’s control. The lure looks boringly normal: fake tax notices, invoices, shipping updates, even DocuSign. The giveaway isn’t the logo, it’s the ask: a password-protected ZIP and a script you have to run just to “view” a document. If you ever see a tax, invoice, shipping, or DocuSign email that wants you to open a password-protected ZIP or run anything, stop and forward it to Security, do not open the ZIP.
Researchers described an active phishing campaign that tricks people with fake Adobe/Zoom update and “document review” themes to install the legitimate ScreenConnect remote-access tool. Once installed, attackers get persistent remote control of the victim’s computer while blending in as normal IT…
Cofense reports multiple real-world campaigns where attackers don’t hack the browser, they trick employees by copying normal browser experiences like login pop-ups, software update prompts, and “verification” checks. The goal is to get users to enter credentials, approve attacker sessions, or run…
Researchers reported a real TA488 campaign where a specially crafted email exploits an Outlook Web Access (OWA) flaw and runs malicious JavaScript as soon as the user opens the message. The attack relies on normal-looking business topics to get people to quickly view the email, and then uses…
AhnLab reports that many APT attacks targeting organizations in South Korea in July 2026 started with spear‑phishing emails that delivered malicious Windows shortcut (LNK) files disguised as legitimate documents (including resumes). When opened, the LNK runs scripts that install…
Researchers reported a real malware campaign where attackers use Spanish-language “voucher claim” messages to trick people into running a Windows Shortcut file. After the user clicks it, the malware pulls commands from an FTP server’s welcome banner and continues downloading additional payloads,…
Cybercriminals sent emails styled like Bank of America that redirected victims to fake pages and pushed a download called “Account Guard.” On Windows, the download installed ScreenConnect remote management software, giving attackers remote control of the device. The campaign used lookalike domains…
