Full Report
An RMM phishing campaign initially associated with Canadian targeting due to its use of Canada Revenue Agency (CRA) tax forms as lures has turned out to be part of a broader campaign spanning 46 countries. Around 45% of observed activity was associated with the United States, making it the campaign's top geographic target. ANY.RUN research connected 601 cases to the wider operation, which uses
Analysis Summary
# Morning News Roll-up September 03, 2026
## Overview
A large-scale phishing campaign leveraging legitimate Remote Monitoring and Management (RMM) software has expanded to 46 countries. While initially appearing to target Canadian citizens with tax-themed lures, the United States has emerged as the primary target, accounting for 45% of the total activity. The operation is characterized by highly volatile infrastructure that rotates daily to evade detection.
## Top Stories
### US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries
- Summary: Researchers have identified a massive social engineering operation using over 600 cases of RMM abuse. The campaign employs localized lures—including tax forms, shipping notices, and government themes—to trick users into installing remote access tools. The threat actor utilizes disposable Vercel and GitHub infrastructure to maintain a low profile.
- Source: hxxps://thehackernews[.]com/2026/09/us-becomes-top-target-in-rmm-phishing[.]html
---
# Main Topic
Global RMM Phishing Campaign abusing legitimate remote management tools and disposable web infrastructure to target 46 countries, with a heavy focus on the United States.
## Key Points
- **Geographic Shift:** Originally linked to Canadian Revenue Agency (CRA) lures, the campaign now targets 46 countries; 45% of activity is directed at the U.S.
- **Infrastructure Volatility:** 94% of the 425 kit URLs identified were active for only a single day.
- **Infrastructure Providers:** Attackers use Vercel, GitHub Pages, Netlify, Amazon S3, Cloudflare R2, and DigitalOcean Spaces for delivery and staging.
- **RMM Abuse:** The campaign bypasses traditional malware detection by installing legitimate RMM software to gain persistent remote access.
- **Industry Impact:** Primary targets include Education, Technology, Government, Banking, Finance, and Manufacturing sectors.
## Threat Actors
- **Attribution:** Not explicitly named, but identified as a sophisticated group capable of managing 600+ concurrent cases and daily infrastructure rotation.
- **Motivations:** Likely financial gain or persistent corporate espionage, given the focus on banking, finance, and government sectors.
## TTPs
- **Social Engineering:** Use of diverse lures including UPS shipping notices, Adobe PDF themes, CRA/Social Security tax notices, and fake invoices.
- **Delivery Chain:** Use of password-protected archives (ZIP) to bypass email security filters.
- **Persistence Mechanism:** Installation of legitimate RMM software to avoid signature-based antivirus detection.
- **Web Tactics:** Rapid rotation of "kit URLs" and hosting on reputable cloud services to inherit domain reputation.
- **Fingerprinting:** Use of specific file structures such as `secure.html` → `project/*.zip` and consistent assets like `font1.woff2`.
## Affected Systems
- **Targeted Environments:** Windows-based systems in corporate and government networks.
- **Software Exploited:** Various legitimate Remote Monitoring and Management (RMM) products (vendor-agnostic).
- **Scope:** 601 cases across 46 countries, including the US, Canada, and various European and Asian nations.
## Mitigations
- **Behavioral Analysis:** Shift focus from static IoCs (like IPs/Domains) to behavioral patterns of RMM software execution.
- **Email Security:** Implement strict controls for password-protected archives and inspect macro-enabled or script-heavy attachments.
- **RMM Governance:** Maintain an allow-list of approved RMM tools and block unauthorized remote access software at the endpoint or network level.
- **User Awareness:** Educate employees on verifying the source of tax-related or shipping-related documents, especially those requiring the download of software to "view" content.
- **Asset Monitoring:** Monitor for specific campaign artifacts such as `icons8-microsoft-word-94.png` and `font1.woff2` in unusual directories.
## Conclusion
This campaign represents a significant shift toward "living off the land" by using legitimate RMM tools and highly ephemeral infrastructure. Because the attack infrastructure changes daily, traditional blocklists are ineffective. Organizations must prioritize behavioral monitoring of remote access tools and implement stricter controls on email-delivered archives to mitigate the risk of unauthorized access.