RMM Phishing: US Top Target Across 46 Countries

A phishing campaign that was initially linked to Canadian tax forms has now been revealed to span 46 countries, with the United States accounting for about 45 percent of observed activity, according to new research from the cybersecurity firm ANY.RUN. The researchers connected 601 cases to this wider operation, which uses fake documents to trick victims into installing legitimate remote monitoring and management (RMM) software. RMM tools are normally used by IT teams to remotely access and control computers, but attackers abuse them to gain the same kind of access without authorization.

The attackers adapt their lures to different targets. ANY.RUN observed fake shipping and UPS communications, Adobe PDF files, tax notices, United States Social Security Administration themes, invoices, and other document types. The campaign makes heavy use of rapidly rotated, disposable infrastructure hosted on Vercel, a cloud platform for deploying web applications. This constant rotation makes the phishing pages harder to track and detect, because each individual URL is only active for a very short time.

ANY.RUN researchers identified 425 kit URLs across 240 hosts, and 94 percent of those URLs were observed for only a single day. The operation has used Vercel, GitHub Pages, Netlify, compromised websites, and other infrastructure to deliver the phishing pages. The malicious payloads have also been staged through services including Amazon S3, Cloudflare R2, GitHub, DigitalOcean Spaces, Dropbox, and GoFile. Despite this rapid rotation, the phishing kit leaves behind more persistent fingerprints. Shared assets such as a file named font1.woff2, recurring image resources, and a specific delivery chain pattern of "secure.html" followed by a "project/*.zip" file helped the researchers connect otherwise separate infrastructure to the same campaign.

The top targeted industries include education, technology, and government, while banking, finance, and manufacturing are also prominently affected. The campaign shows why detection cannot depend only on malware verdicts, domain reputation, or individual indicators of compromise (IOCs). Individual domains and RMM products are disposable, but the underlying delivery chain is more stable. Security operations center (SOC) teams need access to the full behavioral context behind suspicious activity to distinguish legitimate RMM use from abuse.

ANY.RUN offers several detection takeaways for defenders. Teams should build a product-agnostic defense that focuses on the delivery chain and unauthorized remote-access activity, rather than blocking a specific RMM vendor. Because domains change daily, analysts should prioritize more stable kit indicators such as the font1.woff2 asset, an image file named icons8-microsoft-word-94.png, and the secure.html to project/*.zip chain. Email-layer controls and user awareness training should account for password-protected archive delivery. ANY.RUN's Interactive Sandbox exposed the campaign's browser activity, scripts, processes, downloads, and network behavior, while its Threat Intelligence Lookup connected persistent indicators to related infrastructure and cases.

For organizations that need to monitor these kinds of threats in their own environments, security-first IT support such as AEU-I can help teams review delivery chains and detect unauthorized remote-access activity before it causes damage.