US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access

Summary: ANY.RUN researchers traced a US-focused CSuite phishing campaign across 351 sandbox analyses, with 51% of submissions from the United States and India accounting for 18%. The campaign uses business lures themed on Adobe, DocuSign, Zoom, Google Meet, Dropbox, and Microsoft 365 to either install legitimate remote-management tools such as ScreenConnect or Action1 via BAT/VBS droppers, or push victims into credential-harvesting and device-code phishing flows that capture Microsoft 365 access and active sessions.
Key Takeaway: In one sandbox session, an Adobe-themed lure delivered a BAT file that elevated privileges and installed ScreenConnect, turning a single phishing page into remote endpoint access. With technology, manufacturing, government, and consulting among the most exposed sectors, one successful phish can yield both mailbox compromise and persistent access to employee devices.

Read the original at The Hacker News ↗