US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries

Summary: An RMM phishing campaign first tied to Canadian targeting through fake Canada Revenue Agency tax forms has turned out to span 46 countries, with about 45% of observed activity hitting the United States, making it the top geographic target. ANY.RUN linked 601 cases to the operation, which uses fake documents - shipping and UPS notices, Adobe PDFs, tax notices, Social Security Administration themes, invoices - to trick victims into installing legitimate remote monitoring and management software, and which ran 425 kit URLs across 240 hosts, 94% of them seen for only a single day.
Why it matters: The infrastructure rotates faster than the attack pattern: 94% of the campaign's kit URLs lived a single day, while shared fingerprints like font1.woff2 and the secure.html to project/*.zip delivery structure stayed constant - so detection built on individual domains, RMM products, or reputation will keep missing a chain that never changes.

Read the original at The Hacker News ↗