Full Report
The LevelBlue OpsCTI Team recently identified a large-scale phishing campaign leveraging a new social engineering method to deploy unauthorized ConnectWise ScreenConnect clients. Rather than relying on conventional phishing pages, the campaign recreates convincing software update and installation alerts by impersonating the Microsoft Store and Apple App Store while reproducing the look and behavior of trusted applications through dynamic modal dialogs and other interactive web elements. The campaign impersonates trusted software and services, including Google Meet, Adobe Acrobat, Microsoft Teams, Zoom, Docusign, Secure Access Manager, Blue Mountain, Paperless Post, and other popular applications.
Analysis Summary
Based on the report provided, here is a summary of the identified campaign and its associated techniques.
# Tool/Technique: App Store-Themed Phishing & Unauthorized RMM Deployment
## Overview
This campaign utilizes high-fidelity social engineering to deploy unauthorized instances of ConnectWise ScreenConnect (a legitimate Remote Monitoring and Management tool). The attackers move beyond traditional phishing forms by creating interactive web environments that mimic the Microsoft Store, Apple App Store, and Google Meet to trick users into installing "updates" that are actually pre-configured RMM clients.
## Technical Details
- **Type:** Phishing Framework / Unauthorized RMM Deployment
- **Platform:** Windows, macOS
- **Capabilities:** Victim profiling, dynamic UI rendering, automated RMM registration, remote access.
- **First Seen:** July 2026 (per report)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File]
- **[TA0011 - Command and Control]**
- [T1219 - Remote Access Software]
- **[TA0005 - Defense Evasion]**
- [T1036 - Masquerading]
## Functionality
### Core Capabilities
- **Dynamic Impersonation:** Recreates the look and feel of trusted applications (Google Meet, Zoom, Teams) using dynamic modal dialogs and interactive elements.
- **Automated Registration:** Once the victim installs the provided ScreenConnect client, it automatically links to an attacker-controlled instance without further user interaction.
- **Victim Profiling:** Uses AI-assisted scripts to collect telemetry and ensure the victim environment is suitable for infection.
### Advanced Features
- **Browser API Abuse:** Specifically requests MediaDevices API (camera/microphone) to increase the perceived legitimacy of a fake meeting invite before triggering the download.
- **Infrastructure Scalability:** Extensive use of Amazon S3 and Cloudflare R2 for file hosting and resource distribution across thousands of unique phishing domains.
## Indicators of Compromise
### File Hashes (SHA256)
- `424ebbbec7a6498badfe12e973247252ee4f5f789c3f2007e716ec745a3cc55b`
- `9e6875670e605367ad86dfb62b0a42714129c2e83da49e43674a1beb4ada9867`
- `bc9bcb5915fdc314ed0b3de952c83b3380048c4ffd1bc3579b7e1badd7fa9181`
- `246ec497890d94776ccf6bfb14bd5a3568cde115b72926527841255fa0a44aa7`
### File Names
- `InviteJuly26.bat`
- `Q12 2026 SETTLEMENT.bat`
- `INVOICE2515.bat`
- `ViewDoc271.bat`
### Network Indicators
- `stcdubai[.]com/googlemeet/`
- `invite.php` / `meeting.html` (Path structures)
- Attacker-controlled ScreenConnect instances (Various)
## Associated Threat Actors
- **RMS RAT Operators:** While ScreenConnect is the primary tool in this specific campaign, the report notes similarities to services like "RMS RAT" advertised on Russian-language forums which specialize in weaponizing RMM platforms.
## Detection Methods
- **Behavioral Detection:** Monitor for unauthorized installations of RMM tools (ScreenConnect, NetSupport, etc.) especially when initiated from a browser process.
- **Network Monitoring:** Alert on connections to known RMM relay servers that are not part of the organization's approved software inventory.
- **Content Inspection:** Look for HTTP resource hashes associated with the "Fake Update" framework across web gateway logs.
## Mitigation Strategies
- **Software Restriction Policies (SRP):** Prevent the execution of unapproved RMM installers or scripts in temporary directories (e.g., `%TEMP%`, `%APPDATA%`).
- **Application Whitelisting:** Only allow verified, organizationally approved remote support tools.
- **User Education:** Train staff to recognize that legitimate software updates for applications like Google Meet or Zoom typically occur within the app or via official OS update channels, not through browser-based "App Store" popups.
## Related Tools/Techniques
- **RMS RAT:** A commercial service for abusing legitimate RMMs.
- **SocGholish:** A known threat group using similar "Fake Update" lures.
- **Legitimate RMMs:** ConnectWise ScreenConnect, NetSupport, AnyDesk (when used for unauthorized access).